CVE-2026-41673: xmldom uncontrolled recursion in lib/dom.js

CVE-2026-41673 · Severity: high · CVSS 7.5 · Published 2026-05-07

xmldom is a popular JavaScript library for parsing and manipulating XML documents. The library implements common DOM operations using recursive functions that consume call stack memory as trees are traversed. An attacker can craft a deeply nested XML document that exhausts the JavaScript call stack when processed, causing the application to crash with an uncaught RangeError. This denial-of-service vulnerability affects any service that accepts attacker-controlled XML input and performs DOM operations on the result.

Quick answers

Is CVE-2026-41673 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41673 being exploited in the wild.
How severe is CVE-2026-41673?
High severity, with a CVSS score of 7.5, published 7 May 2026.
Which products and versions are affected?
xmldom @xmldom/xmldom < 0.8.13, >= 0.9.0 and < 0.9.10; xmldom xmldom all versions.
Is there a fix for CVE-2026-41673?
A patch was published on 2026-04-18: walkDOM refactor introduced (commit 2d6d691) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41673 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41673?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability affects seven DOM tree traversal operations in lib/dom.js: Node.prototype.normalize(), XMLSerializer.serializeToString(), Element.getElementsByTagName/TagNameNS/ClassName, getElementById(), Node.cloneNode(true), Document.importNode(node, true), node.textContent getter, and Node.isEqualNode(). All share the root cause of pure-JavaScript depth-first recursive traversal without stack depth guards. When processing a deeply nested DOM tree, each recursion level consumes one JavaScript call stack frame; serializeToString crashes at ~5,000 nesting levels (due to namespace.slice() allocations per frame), and the others crash at ~10,000 levels on Node.js 18. The vulnerability requires no authentication or special options—a valid, deeply nested XML document parsed successfully triggers the condition on any subsequent DOM operation. The fix converts all seven traversals from recursive to iterative implementations using a new walkDOM utility that consumes heap memory (an explicit stack array) instead of the call stack.

Affected products

  • xmldom @xmldom/xmldom < 0.8.13, >= 0.9.0 and < 0.9.10
  • xmldom xmldom all versions

Identifiers

  • CVE-2026-41673
  • GHSA-2v35-w6hq-6mfw

Timeline

  • 2026-04-06: disclosed: normalize() vector publicly disclosed via xmldom/xmldom#987
  • 2026-04-22: disclosed: Full advisory GHSA-2v35-w6hq-6mfw published
  • 2026-04-18: patched: walkDOM refactor introduced (commit 2d6d691)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.