CVE-2026-83614

Name	CVE-2026-83614
Description	xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart repeatedly rescans a malformed tag name to the next > during single-character recovery; in lib/dom.js, normalize() repeatedly removes and appends adjacent text nodes, causing quadratic reindexing and string rebuilding. The first path is reachable through default DOMParser.parseFromString() processing, while the second is also reachable through a direct normalize() call on a programmatically constructed DOM, and endDocument invokes that normalization after parsing. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-xmldom (PTS)	bookworm	0.8.6-1	vulnerable
	trixie	0.9.6-1	vulnerable
	forky, sid	0.9.11-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-xmldom	source	(unstable)	(unfixed)

Notes

https://github.com/xmldom/xmldom/security/advisories/GHSA-93r5-fhx6-vmg9
https://github.com/xmldom/xmldom/pull/1071
https://github.com/xmldom/xmldom/pull/1072
Fixed by: https://github.com/xmldom/xmldom/commit/0748720b620555f8c222782dcab575cf0cf403b4 (0.9.12)
Fixed by: https://github.com/xmldom/xmldom/commit/f40ccb861eee0acbf5ee4feb9a34932e87b329c9 (0.8.15)