CVE-2026-83611: xmldom parser silently accepts malformed XML end tags

CVE-2026-83611 · Severity: medium · CVSS 4 · Published 2026-09-01

xmldom is a JavaScript XML parser library used to validate and process XML documents. The parser incorrectly accepts malformed XML end tags (e.g., `</tag⏎junk>`) without reporting errors, while also silently discarding the trailing content. This creates a false sense of validity that could be exploited by applications relying on xmldom to reject invalid XML before trusting the document's content.

Technologies: @xmldom/xmldom (npm), xmldom (npm). Vendors: npm.

Quick answers

Is CVE-2026-83611 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-83611 being exploited in the wild.
How severe is CVE-2026-83611?
Medium severity, with a CVSS score of 4, published 1 September 2026.
Which products and versions are affected?
@xmldom/xmldom (npm) SEMVER:introduced=0.7.0,fixed=0.8.15; xmldom (npm) SEMVER:introduced=0,last_affected=0.6.0.
Is there a fix for CVE-2026-83611?
Yes. @xmldom/xmldom (npm): upgrade to 0.8.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-83611 attacked?
It is attacked over the network.
Am I affected by CVE-2026-83611?
Check whether you run @xmldom/xmldom (npm) or xmldom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @xmldom/xmldom (npm): upgrade to 0.8.15 or later
    npm install @xmldom/xmldom@0.8.15

Technical details

This is a parser differential vulnerability in xmldom's DOM parser. The root cause differs by version: on 0.9.x, an anchored regex for validating end-tag names is compiled with the multiline flag, causing the `$` anchor to match at interior line terminators rather than string end, allowing trailing content after a line break to escape validation; on 0.8.x and earlier, there is no end-tag residue validator at all. The vulnerability allows both whitespace-separated trailing content (e.g., `</a junk>`) and line-terminator-separated content (e.g., `</a⏎junk>`) to be silently accepted. Attack requires no authentication or network capability—it is purely an input parsing issue triggered by sending a crafted XML string to DOMParser. An attacker can craft XML documents that xmldom parses successfully but that the XML specification and browser parsers (Chromium, Firefox) reject as malformed, potentially bypassing validation gates. Patches are available in versions 0.9.12 and 0.8.15; older versions (0.7.x, 0.6.0) are unmaintained and will not receive patches.

Affected products

  • xmldom @xmldom/xmldom >= 0.9.0, <= 0.9.11
  • xmldom @xmldom/xmldom >= 0.8.0, <= 0.8.14
  • xmldom @xmldom/xmldom >= 0.7.0, <= 0.7.13
  • xmldom xmldom <= 0.6.0

Identifiers

  • CVE-2026-83611
  • GHSA-6h8r-xr42-gp59

Timeline

  • 2026-09-08: disclosed: GitHub Advisory GHSA-6h8r-xr42-gp59 published
  • 2026: patched: Patches released: @xmldom/xmldom 0.8.15 and 0.9.12
  • 2026-09-01: advisory: NVD published CVE-2026-83611

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.