Executive brief
xmldom is a popular JavaScript XML parser library used to convert XML and HTML documents into DOM structures. The library suffers from a performance flaw where parsing an element with many attributes consumes exponentially more CPU time due to inefficient duplicate-checking logic. An attacker can send a malicious but well-formed XML document (as small as a few kilobytes when compressed) containing tens of thousands of attributes on a single element, causing the parser to consume seconds of processing time per request and ultimately deny service to legitimate users.
Technical details
The vulnerability exists in the NamedNodeMap.setNamedItem() method used during XML parsing. When an element's attributes are inserted via DOMHandler.startElement(), each attribute insertion calls setAttributeNode(), which invokes getNamedItemNS() to check for duplicates by namespace URI and local name. The getNamedItemNS() method performs a full linear scan of already-inserted attributes, resulting in O(M²) complexity when inserting M distinct attributes. The vulnerable code path applies to all versions: @xmldom/xmldom 0.7.0–0.9.11 and unscoped xmldom 0.1.0–0.6.0. An attacker submits a well-formed XML document containing a single element with tens of thousands of distinct attributes (e.g., <r a0="x" a1="x" ... a32000="x"/>). Parsing this 340 KB document consumes ~1.6–2.1 seconds of single-threaded CPU; doubling the attribute count quadruples the cost. The payload is trivially generated and compresses to a few kilobytes on the wire, making it effective over HTTP/gzip. No authentication, special options, or malformed markup is required—parsing completes silently. A patch has been released in @xmldom/xmldom 0.8.15 and 0.9.12 that replaces the linear dedup scan with a name-keyed index, reducing complexity to O(M).
Affected products
- xmldom @xmldom/xmldom >=0.7.0, <=0.8.14 and >=0.9.0, <=0.9.11
- xmldom xmldom <=0.6.0
Timeline
- 2026-08-21: disclosed
- 2026-09-08: advisory: GitHub Security Advisory GHSA-8344-3jmq-59r6 published
- 2026-09-08: patched: Patches released for @xmldom/xmldom 0.8.15 and 0.9.12