CVE-2026-83619: xmldom end-tag whitespace-trim ReDoS

CVE-2026-83619 · Severity: high · CVSS 4 · Published 2026-09-01

xmldom is a popular JavaScript XML parser used in Node.js applications to read and process XML data. A flaw in how it trims whitespace from XML end tags causes the parser to hang for seconds when processing a specially crafted document, blocking the entire application. An attacker can exploit this by sending a small XML file to any application that parses untrusted XML, causing service downtime without exposing data or compromising accounts.

Technologies: @xmldom/xmldom (npm). Vendors: npm.

Quick answers

Is CVE-2026-83619 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-83619 being exploited in the wild.
How severe is CVE-2026-83619?
High severity, with a CVSS score of 4, published 1 September 2026.
Which products and versions are affected?
@xmldom/xmldom (npm) >= 0.7.0, <= 0.8.14, SEMVER:introduced=0.7.0,fixed=0.8.15.
Is there a fix for CVE-2026-83619?
Yes. @xmldom/xmldom (npm): upgrade to 0.8.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-83619 attacked?
It is attacked over the network.
Am I affected by CVE-2026-83619?
Check whether you run @xmldom/xmldom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @xmldom/xmldom (npm): upgrade to 0.8.15 or later
    npm install @xmldom/xmldom@0.8.15

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) in lib/sax.js line 120 of xmldom versions 0.7.0 through 0.8.14. The unanchored regex `/[ \t\n\r]+$/g` trims trailing whitespace from end-tag names; when applied to a string with a long whitespace run followed by a non-whitespace character (e.g., `</ … x>`), the regex engine exhibits classic O(n²) backtracking: for each position, it extends `[ws]+` to the end, then fails the `$` anchor at the final non-whitespace character, forcing the engine to retry from the next position. The substring length is controlled by the attacker via `indexOf('>')`. With 64 KB of whitespace, the parse stalls for ~1.4 seconds on Node.js 18; the complexity is quadratic (not exponential), so tens-to-hundreds of KB of input causes multi-second hangs. The flaw is reachable from DOMParser.parseFromString under default options, before any validity checks. Version 0.9.x is unaffected (it uses an anchored linear matcher); the unscoped npm package `xmldom` is unaffected (the vulnerable code was never released to npm, only in a git tag).

Affected products

  • xmldom @xmldom/xmldom 0.7.0 through 0.8.14; fixed in 0.8.15

Identifiers

  • CVE-2026-83619
  • GHSA-x4fp-j954-r2f4

Timeline

  • 2026-08-21: disclosed: Vulnerability published in GitHub Advisory Database
  • 2026-09-08: patched: Fix anchors the regex to run in linear time; patch available in version 0.8.15
  • 2026-09-08: advisory: CVE-2026-83619 assigned and published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.