EXECUTIVE SUMMARY:
Multiple vulnerabilities in the @xmldom/xmldom package disclose XML/HTML parsing and serialization weaknesses, including attribute and element-name injection, DocType and processing-instruction injection, requireWellFormed validation bypasses, and several denial-of-service conditions caused by quadratic-time parsing, regular-expression backtracking, output amplification, and quadratic memory consumption. Depending on application usage, successful exploitation can result in XML/HTML injection, XSS, integrity impact, CPU exhaustion, memory exhaustion, or parser-based denial of service.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
Multiple vulnerabilities in the @xmldom/xmldom package disclose XML/HTML parsing and serialization weaknesses, including attribute and element-name injection, DocType and processing-instruction injection, requireWellFormed validation bypasses, and several denial-of-service conditions caused by quadratic-time parsing, regular-expression backtracking, output amplification, and quadratic memory consumption. Depending on application usage, successful exploitation can result in XML/HTML injection, XSS, integrity impact, CPU exhaustion, memory exhaustion, or parser-based denial of service.[emaillocker id="1283"]
CVE-2026-83605 (CVSS 8.7 — High): Attribute name injection via setAttribute bypasses requireWellFormed by storing the raw `tagName` string without any validation, allowing an attacker to inject additional attributes into serialized output.
CVE-2026-83607 (CVSS 8.7 — High): Element name injection via createElement bypasses requireWellFormed by accepting arbitrary strings as the `tagName` parameter with zero validation, enabling an attacker to inject event handler attributes into HTML output consumed by browsers.
CVE-2026-83606 (CVSS 8.7 — High): Processing-instruction (PI) grammar regex exhibits quadratic-time backtracking (ReDoS) when parsing an unterminated processing instruction, allowing an attacker to stall the Node.js event loop and potentially execute arbitrary code.
CVE-2026-83612 (CVSS 8.7 — High): It is a denial-of-service vulnerability in @xmldom/xmldom that causes quadratic CPU and memory consumption when parsing and serializing crafted HTML with mixed-case closing tags.
CVE-2026-83614 (CVSS 8.7 — High): It is a denial-of-service vulnerability in @xmldom/xmldom that causes quadratic CPU consumption in parseElementStartPart during malformed XML parsing and adjacent text-node normalization, potentially stalling the Node.js event loop.
CVE-2026-83615 (CVSS 8.7 — High): It is a vulnerability in @xmldom/xmldom that causes O(N²) memory consumption when parsing deeply nested XML elements with unique namespace prefixes, potentially exhausting the heap and crashing the process.
CVE-2026-83619 (CVSS 8.7 — High): It is a vulnerability in @xmldom/xmldom that causes quadratic-time regular-expression backtracking when parsing crafted XML end tags with long whitespace sequences, potentially stalling the Node.js event loop.
CVE-2026-83613 (CVSS 8.7 — High): It is a vulnerability in @xmldom/xmldom that causes quadratic processing when parsing an element containing a large number of distinct attributes due to linear attribute deduplication scans, potentially causing performance degradation.
CVE-2026-83611 (CVSS 6.9 — Medium): It is a vulnerability in @xmldom/xmldom that silently accepts malformed XML end tags with trailing content, potentially allowing applications to bypass well-formedness and input-validation checks.
CVE-2026-83618 (CVSS 8.7 — High): It is a vulnerability in @xmldom/xmldom that allows a line-terminator bypass of the requireWellFormed serializer check, potentially enabling XML structure injection through a DocumentType's publicId or systemId.
CVE-2026-83609 (CVSS 8.7 — High): It is a vulnerability in @xmldom/xmldom that allows line-terminator bypasses in qualified-name validation, enabling malformed names to be accepted and serialized verbatim, potentially resulting in markup or structure injection.
CVE-2026-83608 (CVSS 8.7 — High): It is a vulnerability in @xmldom/xmldom that allows an invalid DocumentType.name to be serialized verbatim, bypassing requireWellFormed validation and potentially enabling XML/markup structure injection and XSS.
CVE-2026-83617 (CVSS 8.7 — High): It is a vulnerability in @xmldom/xmldom that allows embedded line terminators to bypass requireWellFormed validation for element and attribute names, potentially enabling XML/markup structure injection and downstream XSS.
CVE-2026-83616 (CVSS 8.7 — High): It is a vulnerability in @xmldom/xmldom that allows > characters in processing-instruction targets to bypass requireWellFormed validation, potentially enabling XML structure injection and downstream XSS.
RECOMMENDATIONS:
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-4w3w-2rp5-g8jm
https://github.com/advisories/GHSA-w2rr-34g9-rvrj
https://github.com/advisories/GHSA-g53g-w8rj-fmg7
https://github.com/advisories/GHSA-6mj3-qw4j-hgrw
https://github.com/advisories/GHSA-93r5-fhx6-vmg9
https://github.com/advisories/GHSA-965w-775f-mr7g
https://github.com/advisories/GHSA-x4fp-j954-r2f4
https://github.com/advisories/GHSA-8344-3jmq-59r6
https://github.com/advisories/GHSA-6h8r-xr42-gp59
https://github.com/advisories/GHSA-vr34-hp96-76pp
https://github.com/advisories/GHSA-3px3-54cx-rmw9
https://github.com/advisories/GHSA-27p8-2357-5qqv
https://github.com/advisories/GHSA-jxjr-3g7g-3944
https://github.com/advisories/GHSA-c7q8-3ch8-vqpv