CVE-2026-83614: xmldom quadratic-time parsing denial of service

CVE-2026-83614 · Severity: high · CVSS 4 · Published 2026-09-01

xmldom is a JavaScript library that parses and serializes XML documents in Node.js and browsers. A parsing flaw allows an attacker to send a specially crafted XML document that causes the application to spend seconds processing it, freezing the server and denying service to legitimate users. The malicious document is small (tens of kilobytes) and highly compressible, making it easy to deliver over the network. Additionally, applications that build DOM trees programmatically and call the normalize() method can suffer the same performance problem independent of parsing.

Technologies: @xmldom/xmldom (npm), xmldom (npm). Vendors: npm.

Quick answers

Is CVE-2026-83614 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-83614 being exploited in the wild.
How severe is CVE-2026-83614?
High severity, with a CVSS score of 4, published 1 September 2026.
Which products and versions are affected?
@xmldom/xmldom (npm) SEMVER:introduced=0.7.0,fixed=0.8.15; xmldom (npm) SEMVER:introduced=0.3.0,last_affected=0.6.0.
Is there a fix for CVE-2026-83614?
Yes. @xmldom/xmldom (npm): upgrade to 0.8.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-83614 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-83614?
Check whether you run @xmldom/xmldom (npm) or xmldom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @xmldom/xmldom (npm): upgrade to 0.8.15 or later
    npm install @xmldom/xmldom@0.8.15

Technical details

The vulnerability consists of two separate quadratic-time (O(n²)) algorithmic flaws triggered together by a single malformed input. Finding A: parseElementStartPart performs an O(n) character-by-character scan to recover from embedded angle brackets in malformed tag names; when error recovery loops, the repeated O(n) scans plus O(n) regex validation combine to O(n²). Finding B: normalize() merges K adjacent text nodes (produced by Finding A's single-character recovery emissions) by repeatedly calling removeChild (which re-indexes all O(K) siblings) and appendData (which rebuilds the string accumulator), yielding O(K²). Both findings affect xmldom 0.8.x (≤0.8.14) and 0.9.x (≤0.9.11), and the retired 0.3.x–0.6.x line. Finding B is also reachable via direct public normalize() calls on DOMs with adjacent text nodes, independent of the parser. Patched versions: 0.8.15, 0.9.12.

Affected products

  • xmldom @xmldom/xmldom >=0.7.0, <=0.8.14; >=0.9.0, <=0.9.11
  • xmldom xmldom >=0.3.0, <=0.6.0

Identifiers

  • CVE-2026-83614
  • GHSA-93r5-fhx6-vmg9

Timeline

  • 2026-08-21: disclosed: Vulnerability disclosed on GitHub Advisory Database
  • 2026-09-08: advisory: Advisory published and updated with full details
  • 2026-09-08: patched: Patches released: @xmldom/xmldom 0.8.15 and 0.9.12

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.