Junglewise Threat Intelligence

CVE-2026-83619: xmldom end-tag whitespace-trim ReDoS

CVE-2026-83619 · Severity: high · CVSS 8.7 · Published 2026-09-08

Executive brief

xmldom is a popular JavaScript XML parser used in Node.js applications to read and process XML data. A flaw in how it trims whitespace from XML end tags causes the parser to hang for seconds when processing a specially crafted document, blocking the entire application. An attacker can exploit this by sending a small XML file to any application that parses untrusted XML, causing service downtime without exposing data or compromising accounts.

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) in lib/sax.js line 120 of xmldom versions 0.7.0 through 0.8.14. The unanchored regex `/[ \t\n\r]+$/g` trims trailing whitespace from end-tag names; when applied to a string with a long whitespace run followed by a non-whitespace character (e.g., `</ … x>`), the regex engine exhibits classic O(n²) backtracking: for each position, it extends `[ws]+` to the end, then fails the ` Junglewise anchor at the final non-whitespace character, forcing the engine to retry from the next position. The substring length is controlled by the attacker via `indexOf('>')`. With 64 KB of whitespace, the parse stalls for ~1.4 seconds on Node.js 18; the complexity is quadratic (not exponential), so tens-to-hundreds of KB of input causes multi-second hangs. The flaw is reachable from DOMParser.parseFromString under default options, before any validity checks. Version 0.9.x is unaffected (it uses an anchored linear matcher); the unscoped npm package `xmldom` is unaffected (the vulnerable code was never released to npm, only in a git tag).

Affected products

  • xmldom @xmldom/xmldom 0.7.0 through 0.8.14; fixed in 0.8.15

Timeline

  • 2026-08-21: disclosed: Vulnerability published in GitHub Advisory Database
  • 2026-09-08: patched: Fix anchors the regex to run in linear time; patch available in version 0.8.15
  • 2026-09-08: advisory: CVE-2026-83619 assigned and published to NVD

References

Related threats