Executive brief
xmldom is a JavaScript library that parses and serializes XML documents in Node.js and browsers. A parsing flaw allows an attacker to send a specially crafted XML document that causes the application to spend seconds processing it, freezing the server and denying service to legitimate users. The malicious document is small (tens of kilobytes) and highly compressible, making it easy to deliver over the network. Additionally, applications that build DOM trees programmatically and call the normalize() method can suffer the same performance problem independent of parsing.
Technical details
The vulnerability consists of two separate quadratic-time (O(n²)) algorithmic flaws triggered together by a single malformed input. Finding A: parseElementStartPart performs an O(n) character-by-character scan to recover from embedded angle brackets in malformed tag names; when error recovery loops, the repeated O(n) scans plus O(n) regex validation combine to O(n²). Finding B: normalize() merges K adjacent text nodes (produced by Finding A's single-character recovery emissions) by repeatedly calling removeChild (which re-indexes all O(K) siblings) and appendData (which rebuilds the string accumulator), yielding O(K²). Both findings affect xmldom 0.8.x (≤0.8.14) and 0.9.x (≤0.9.11), and the retired 0.3.x–0.6.x line. Finding B is also reachable via direct public normalize() calls on DOMs with adjacent text nodes, independent of the parser. Patched versions: 0.8.15, 0.9.12.
Affected products
- xmldom @xmldom/xmldom >=0.7.0, <=0.8.14; >=0.9.0, <=0.9.11
- xmldom xmldom >=0.3.0, <=0.6.0
Timeline
- 2026-08-21: disclosed: Vulnerability disclosed on GitHub Advisory Database
- 2026-09-08: advisory: Advisory published and updated with full details
- 2026-09-08: patched: Patches released: @xmldom/xmldom 0.8.15 and 0.9.12