CVE-2026-83613: xmldom quadratic-time attribute deduplication

CVE-2026-83613 · Severity: high · CVSS 4 · Published 2026-09-01

xmldom is a popular JavaScript XML parser library used to convert XML and HTML documents into DOM structures. The library suffers from a performance flaw where parsing an element with many attributes consumes exponentially more CPU time due to inefficient duplicate-checking logic. An attacker can send a malicious but well-formed XML document (as small as a few kilobytes when compressed) containing tens of thousands of attributes on a single element, causing the parser to consume seconds of processing time per request and ultimately deny service to legitimate users.

Technologies: @xmldom/xmldom (npm), xmldom (npm). Vendors: npm.

Quick answers

Is CVE-2026-83613 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-83613 being exploited in the wild.
How severe is CVE-2026-83613?
High severity, with a CVSS score of 4, published 1 September 2026.
Which products and versions are affected?
@xmldom/xmldom (npm) SEMVER:introduced=0.7.0,fixed=0.8.15; xmldom (npm) SEMVER:introduced=0,last_affected=0.6.0.
Is there a fix for CVE-2026-83613?
Yes. @xmldom/xmldom (npm): upgrade to 0.8.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-83613 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-83613?
Check whether you run @xmldom/xmldom (npm) or xmldom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @xmldom/xmldom (npm): upgrade to 0.8.15 or later
    npm install @xmldom/xmldom@0.8.15

Technical details

The vulnerability exists in the NamedNodeMap.setNamedItem() method used during XML parsing. When an element's attributes are inserted via DOMHandler.startElement(), each attribute insertion calls setAttributeNode(), which invokes getNamedItemNS() to check for duplicates by namespace URI and local name. The getNamedItemNS() method performs a full linear scan of already-inserted attributes, resulting in O(M²) complexity when inserting M distinct attributes. The vulnerable code path applies to all versions: @xmldom/xmldom 0.7.0–0.9.11 and unscoped xmldom 0.1.0–0.6.0. An attacker submits a well-formed XML document containing a single element with tens of thousands of distinct attributes (e.g., <r a0="x" a1="x" ... a32000="x"/>). Parsing this 340 KB document consumes ~1.6–2.1 seconds of single-threaded CPU; doubling the attribute count quadruples the cost. The payload is trivially generated and compresses to a few kilobytes on the wire, making it effective over HTTP/gzip. No authentication, special options, or malformed markup is required—parsing completes silently. A patch has been released in @xmldom/xmldom 0.8.15 and 0.9.12 that replaces the linear dedup scan with a name-keyed index, reducing complexity to O(M).

Affected products

  • xmldom @xmldom/xmldom >=0.7.0, <=0.8.14 and >=0.9.0, <=0.9.11
  • xmldom xmldom <=0.6.0

Identifiers

  • CVE-2026-83613
  • GHSA-8344-3jmq-59r6

Timeline

  • 2026-08-21: disclosed
  • 2026-09-08: advisory: GitHub Security Advisory GHSA-8344-3jmq-59r6 published
  • 2026-09-08: patched: Patches released for @xmldom/xmldom 0.8.15 and 0.9.12

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.