CVE-2026-83611: xmldom parser silently accepts malformed XML end tags
CVE-2026-83611 · Severity: medium · CVSS 4 · Published 2026-09-08
Executive brief
xmldom is a JavaScript XML parser library used to validate and process XML documents. The parser incorrectly accepts malformed XML end tags (e.g., `</tag⏎junk>`) without reporting errors, while also silently discarding the trailing content. This creates a false sense of validity that could be exploited by applications relying on xmldom to reject invalid XML before trusting the document's content.
Technical details
This is a parser differential vulnerability in xmldom's DOM parser. The root cause differs by version: on 0.9.x, an anchored regex for validating end-tag names is compiled with the multiline flag, causing the `
Junglewise
anchor to match at interior line terminators rather than string end, allowing trailing content after a line break to escape validation; on 0.8.x and earlier, there is no end-tag residue validator at all. The vulnerability allows both whitespace-separated trailing content (e.g., `</a junk>`) and line-terminator-separated content (e.g., `</a⏎junk>`) to be silently accepted. Attack requires no authentication or network capability—it is purely an input parsing issue triggered by sending a crafted XML string to DOMParser. An attacker can craft XML documents that xmldom parses successfully but that the XML specification and browser parsers (Chromium, Firefox) reject as malformed, potentially bypassing validation gates. Patches are available in versions 0.9.12 and 0.8.15; older versions (0.7.x, 0.6.0) are unmaintained and will not receive patches.
Affected products
xmldom @xmldom/xmldom >= 0.9.0, <= 0.9.11
xmldom @xmldom/xmldom >= 0.8.0, <= 0.8.14
xmldom @xmldom/xmldom >= 0.7.0, <= 0.7.13
xmldom xmldom <= 0.6.0
Timeline
2026-09-08: disclosed: GitHub Advisory GHSA-6h8r-xr42-gp59 published
2026: patched: Patches released: @xmldom/xmldom 0.8.15 and 0.9.12
2026-09-01: advisory: NVD published CVE-2026-83611