CVE-2026-83615: xmldom quadratic-memory consumption in namespace parsing

CVE-2026-83615 · Severity: high · CVSS 4 · Published 2026-09-01

xmldom is a JavaScript library that parses XML documents into the DOM (Document Object Model). When processing XML with deeply nested namespace declarations, the parser accumulates redundant copies of namespace maps in memory, consuming quadratic (O(N²)) heap space during parsing. An attacker can send a crafted sub-megabyte XML document that causes the parser to exhaust available memory and crash the application before any validation occurs, resulting in a complete denial of service with a trivial, highly compressible payload.

Technologies: @xmldom/xmldom (npm), xmldom (npm). Vendors: npm.

Quick answers

Is CVE-2026-83615 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-83615 being exploited in the wild.
How severe is CVE-2026-83615?
High severity, with a CVSS score of 4, published 1 September 2026.
Which products and versions are affected?
@xmldom/xmldom (npm) SEMVER:introduced=0.7.0,fixed=0.8.15; xmldom (npm) SEMVER:introduced=0.1.5,last_affected=0.6.0.
Is there a fix for CVE-2026-83615?
Yes. @xmldom/xmldom (npm): upgrade to 0.8.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-83615 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-83615?
Check whether you run @xmldom/xmldom (npm) or xmldom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @xmldom/xmldom (npm): upgrade to 0.8.15 or later
    npm install @xmldom/xmldom@0.8.15

Technical details

The vulnerability is a resource exhaustion flaw (CWE-770) in the `appendElement` function within xmldom's SAX parser. When an XML element declares a namespace prefix, the parser invokes `_copy` to clone the current namespace map into a fresh object for each prefix-declaring element, retaining this copy on the element's parse-stack entry. Because every ancestor element remains live on the parse stack until closing, deeply nested documents with unique namespace prefixes at each level cause the parser to hold Σi namespace entries (summing to O(N²) at peak). The attack requires no authentication, privileges, or user interaction; a single network-delivered XML request of trivial complexity drives multi-gigabyte peak memory consumption and OOM-crashes the process before application-level validation (e.g., SAML signature verification, schema checks) can execute. The payload is highly compressible, making it effective over compressed HTTP transports. Patches are available: version 0.8.15 and 0.9.12 fix the issue by using prototype-chain inheritance instead of object copying, reducing peak memory to O(N) while preserving byte-identical serialized output.

Affected products

  • xmldom @xmldom/xmldom 0.7.0 through 0.8.14, 0.9.0 through 0.9.11
  • xmldom xmldom 0.1.5 through 0.6.0

Identifiers

  • CVE-2026-83615
  • GHSA-965w-775f-mr7g

Timeline

  • 2026-09-08: disclosed: Published to GitHub Advisory Database
  • 2026-09-08: patched: Patched versions 0.8.15 and 0.9.12 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.