CVE-2026-83612
published 2026-09-01CVE-2026-83612: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing…
PriorityP350high8.7CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.52%
43.6th percentile
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements. parseHtmlSpecialContent, selected by isHTMLRawTextElement or isHTMLEscapableRawTextElement, uses a case-sensitive indexOf() and then calls substring() with a missing-close result of negative one, causing unstable parser progression and quadratic output amplification. A small untrusted text/html document can consequently consume disproportionate CPU and memory when parsed and serialized. This issue is fixed in @xmldom/xmldom version 0.9.12.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openshift4 | ose-console | — | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | >= 0.9.0-beta.1 < 0.9.12 | 0.9.12 |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
xmldom: HTML raw-text closing-tag case mismatch causes output amplification
ghsa·2026-09-08
CVE-2026-83612 [HIGH] CWE-178 xmldom: HTML raw-text closing-tag case mismatch causes output amplification
xmldom: HTML raw-text closing-tag case mismatch causes output amplification
## Summary
In HTML mode (`text/html`), a raw-text element (`script`, `style`, `textarea`, `title`) whose closing
tag differs in case from its opening tag (e.g. `` for ``) is mishandled by the
parser, producing quadratic (O(n²)) output growth — a small crafted document parses and serializes
into output orders of magnitude larger, exhausting CPU and memory. A modest input of tens of KB can
therefore cause a denial of service in any service that parses untrusted HTML with xmldom. Only HTML
mode is affected.
## Details
The parser calls `parseHtmlSpecialContent` for each raw-text element in HTML mode, matched via
`isHTMLRawTextElement` / `isHTMLEscapableRawTextElement` (so all four types — `script`, `style`,
`textar
VulDB
xmldom up to 0.9.11 HTML Parser DOMParser.parseFromString redos (Nessus ID 342311)
vuldb·2026-09-03·CVSS 8.7
CVE-2026-83612 [HIGH] xmldom up to 0.9.11 HTML Parser DOMParser.parseFromString redos (Nessus ID 342311)
A vulnerability categorized as problematic has been discovered in xmldom up to 0.9.11. This impacts the function DOMParser.parseFromString of the component HTML Parser. The manipulation results in inefficient regular expression complexity.
This vulnerability is reported as CVE-2026-83612. The attack can be launched remotely. No exploit exists.
It is advisable to upgrade the affected component.
Red Hat
xmldom: xmldom: Denial of Service via crafted HTML with mixed-case tags
vendor_redhat·2026-09-01·CVSS 8.7
CVE-2026-83612 [HIGH] CWE-178 xmldom: xmldom: Denial of Service via crafted HTML with mixed-case tags
xmldom: xmldom: Denial of Service via crafted HTML with mixed-case tags
A flaw was found in xmldom, a JavaScript module used for parsing HTML documents. This vulnerability allows a remote attacker to craft a malicious HTML document with specific mixed-case closing tags. When processed, this document can cause the parser to consume excessive CPU and memory, leading to a denial of service for the application.
Package: openshift4/ose-console (Red Hat OpenShift Container Platform 4) - Affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-83612 onnxruntime: xmldom: Denial of Service via crafted HTML with mixed-case tags [fedora-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83612 [HIGH] CVE-2026-83612 onnxruntime: xmldom: Denial of Service via crafted HTML with mixed-case tags [fedora-all]
CVE-2026-83612 onnxruntime: xmldom: Denial of Service via crafted HTML with mixed-case tags [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements. parseHtmlSpecialContent, selected by isHTMLRawTextElement or isHTMLEscapableRawTextElement, uses a case-sensitive indexOf() and then calls substring() with a missing-close result o
Bugzilla
CVE-2026-83612 jupyterlab: xmldom: Denial of Service via crafted HTML with mixed-case tags [fedora-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83612 [HIGH] CVE-2026-83612 jupyterlab: xmldom: Denial of Service via crafted HTML with mixed-case tags [fedora-all]
CVE-2026-83612 jupyterlab: xmldom: Denial of Service via crafted HTML with mixed-case tags [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements. parseHtmlSpecialContent, selected by isHTMLRawTextElement or isHTMLEscapableRawTextElement, uses a case-sensitive indexOf() and then calls substring() with a missing-close result of
Bugzilla
CVE-2026-83612 crow-translate: xmldom: Denial of Service via crafted HTML with mixed-case tags [fedora-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83612 [HIGH] CVE-2026-83612 crow-translate: xmldom: Denial of Service via crafted HTML with mixed-case tags [fedora-all]
CVE-2026-83612 crow-translate: xmldom: Denial of Service via crafted HTML with mixed-case tags [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements. parseHtmlSpecialContent, selected by isHTMLRawTextElement or isHTMLEscapableRawTextElement, uses a case-sensitive indexOf() and then calls substring() with a missing-close resul
Bugzilla
CVE-2026-83612 jupyterlab: xmldom: Denial of Service via crafted HTML with mixed-case tags [epel-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83612 [HIGH] CVE-2026-83612 jupyterlab: xmldom: Denial of Service via crafted HTML with mixed-case tags [epel-all]
CVE-2026-83612 jupyterlab: xmldom: Denial of Service via crafted HTML with mixed-case tags [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements. parseHtmlSpecialContent, selected by isHTMLRawTextElement or isHTMLEscapableRawTextElement, uses a case-sensitive indexOf() and then calls substring() with a missing-close result of n
Bugzilla
CVE-2026-83612 kf6-breeze-icons: xmldom: Denial of Service via crafted HTML with mixed-case tags [fedora-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83612 [HIGH] CVE-2026-83612 kf6-breeze-icons: xmldom: Denial of Service via crafted HTML with mixed-case tags [fedora-all]
CVE-2026-83612 kf6-breeze-icons: xmldom: Denial of Service via crafted HTML with mixed-case tags [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements. parseHtmlSpecialContent, selected by isHTMLRawTextElement or isHTMLEscapableRawTextElement, uses a case-sensitive indexOf() and then calls substring() with a missing-close res
Bugzilla
CVE-2026-83612 kf6-breeze-icons: xmldom: Denial of Service via crafted HTML with mixed-case tags [epel-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83612 [HIGH] CVE-2026-83612 kf6-breeze-icons: xmldom: Denial of Service via crafted HTML with mixed-case tags [epel-all]
CVE-2026-83612 kf6-breeze-icons: xmldom: Denial of Service via crafted HTML with mixed-case tags [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements. parseHtmlSpecialContent, selected by isHTMLRawTextElement or isHTMLEscapableRawTextElement, uses a case-sensitive indexOf() and then calls substring() with a missing-close resul
Bugzilla
CVE-2026-83612 xmldom: xmldom: Denial of Service via crafted HTML with mixed-case tags
bugzilla·2026-09-01·CVSS 8.7
CVE-2026-83612 [HIGH] CVE-2026-83612 xmldom: xmldom: Denial of Service via crafted HTML with mixed-case tags
CVE-2026-83612 xmldom: xmldom: Denial of Service via crafted HTML with mixed-case tags
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements. parseHtmlSpecialContent, selected by isHTMLRawTextElement or isHTMLEscapableRawTextElement, uses a case-sensitive indexOf() and then calls substring() with a missing-close result of negative one, causing unstable parser progression and quadratic output amplification. A small untrusted text/html document can consequently consume disproportionate CPU and memory when parsed and serialized. This issue is fixed in @xmldom/xm
https://github.com/xmldom/xmldom/commit/7ced40c06c28d151e996a97045018c3559ae4707https://github.com/xmldom/xmldom/pull/1071https://github.com/xmldom/xmldom/releases/tag/0.9.12https://github.com/xmldom/xmldom/security/advisories/GHSA-6mj3-qw4j-hgrwhttps://github.com/xmldom/xmldom/security/advisories/GHSA-6mj3-qw4j-hgrw
2026-09-01
Published