Junglewise Threat Intelligence

CVE-2026-41673: xmldom uncontrolled recursion in lib/dom.js

CVE-2026-41673 · Severity: high · CVSS 7.5 · Published 2026-05-07

Technologies: Xmldom, Xmldom @Xmldom/Xmldom.

Executive brief

xmldom is a popular JavaScript library for parsing and manipulating XML documents. The library implements common DOM operations using recursive functions that consume call stack memory as trees are traversed. An attacker can craft a deeply nested XML document that exhausts the JavaScript call stack when processed, causing the application to crash with an uncaught RangeError. This denial-of-service vulnerability affects any service that accepts attacker-controlled XML input and performs DOM operations on the result.

Technical details

The vulnerability affects seven DOM tree traversal operations in lib/dom.js: Node.prototype.normalize(), XMLSerializer.serializeToString(), Element.getElementsByTagName/TagNameNS/ClassName, getElementById(), Node.cloneNode(true), Document.importNode(node, true), node.textContent getter, and Node.isEqualNode(). All share the root cause of pure-JavaScript depth-first recursive traversal without stack depth guards. When processing a deeply nested DOM tree, each recursion level consumes one JavaScript call stack frame; serializeToString crashes at ~5,000 nesting levels (due to namespace.slice() allocations per frame), and the others crash at ~10,000 levels on Node.js 18. The vulnerability requires no authentication or special options—a valid, deeply nested XML document parsed successfully triggers the condition on any subsequent DOM operation. The fix converts all seven traversals from recursive to iterative implementations using a new walkDOM utility that consumes heap memory (an explicit stack array) instead of the call stack.

Affected products

  • xmldom @xmldom/xmldom < 0.8.13, >= 0.9.0 and < 0.9.10
  • xmldom xmldom all versions

Timeline

  • 2026-04-06: disclosed: normalize() vector publicly disclosed via xmldom/xmldom#987
  • 2026-04-22: disclosed: Full advisory GHSA-2v35-w6hq-6mfw published
  • 2026-04-18: patched: walkDOM refactor introduced (commit 2d6d691)

References