CVE-2026-83614
published 2026-09-01CVE-2026-83614: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12…
PriorityP351high8.7CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.59%
47.5th percentile
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart repeatedly rescans a malformed tag name to the next > during single-character recovery; in lib/dom.js, normalize() repeatedly removes and appends adjacent text nodes, causing quadratic reindexing and string rebuilding. The first path is reachable through default DOMParser.parseFromString() processing, while the second is also reachable through a direct normalize() call on a programmatically constructed DOM, and endDocument invokes that normalization after parsing. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana | — | — |
| openshift4 | ose-console | — | — |
| rhdh | rhdh-hub-rhel9 | — | — |
| rhoai | odh-mlflow-rhel9 | — | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | 0.3.0 – 0.6.0 | — |
| xmldom | xmldom | >= 0.7.0 < 0.8.15 | 0.8.15 |
| xmldom | xmldom | >= 0.9.0 < 0.9.12 | 0.9.12 |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
ghsa·2026-09-08
CVE-2026-83614 [HIGH] CWE-400 xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
## Summary
`xmldom`'s malformed-input **error-recovery path** has two quadratic-time (O(n²)) behaviors that a
single crafted input triggers together, so a tiny, highly compressible document (tens of KB) stalls
the Node.js event loop for multiple seconds. It is reachable from `DOMParser.parseFromString` under
**default options** — i.e. from unauthenticated, network-delivered XML — making this an unauthenticated
denial of service. One of the two behaviors, the `normalize()` adjacent-text merge, is **additionally
reachable programmatically** — via a plain `normalize()` call on a DOM built with adjacent text nodes,
independent of the parser — so its fix
Red Hat
xmldom: @xmldom/xmldom: xmldom: Denial of Service via quadratic-time XML parsing
vendor_redhat·2026-09-01·CVSS 8.7
CVE-2026-83614 [HIGH] CWE-1333 xmldom: @xmldom/xmldom: xmldom: Denial of Service via quadratic-time XML parsing
xmldom: @xmldom/xmldom: xmldom: Denial of Service via quadratic-time XML parsing
A flaw was found in xmldom. Two independent quadratic paths in the XML DOM (Document Object Model) parser can lead to a denial of service (DoS). A remote attacker could exploit this by providing specially crafted XML input, causing the parser to repeatedly rescan malformed tag names or reindex and rebuild strings during normalization. This excessive processing consumes system resources, making the application unresponsive.
Package: rh-podman-desktop.git (Red Hat Build of Podman Desktop) - Affected
Package: rhdh/rhdh-hub-rhel9 (Red Hat Developer Hub) - Affected
Package: grafana (Red Hat Enterprise Linux 10) - Affected
Package: grafana (Red Hat Enterprise Linux 8) - Affected
Package: grafana (Red Hat Enter
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-83614 onnxruntime: xmldom: Denial of Service via quadratic-time XML parsing [fedora-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83614 [HIGH] CVE-2026-83614 onnxruntime: xmldom: Denial of Service via quadratic-time XML parsing [fedora-all]
CVE-2026-83614 onnxruntime: xmldom: Denial of Service via quadratic-time XML parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart repeatedly rescans a malformed tag name to the next > during single-character recovery; in lib/dom.js, normalize() repeatedly removes and appends adjacent text nodes, causing q
Bugzilla
CVE-2026-83614 jupyterlab: xmldom: Denial of Service via quadratic-time XML parsing [fedora-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83614 [HIGH] CVE-2026-83614 jupyterlab: xmldom: Denial of Service via quadratic-time XML parsing [fedora-all]
CVE-2026-83614 jupyterlab: xmldom: Denial of Service via quadratic-time XML parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart repeatedly rescans a malformed tag name to the next > during single-character recovery; in lib/dom.js, normalize() repeatedly removes and appends adjacent text nodes, causing qu
Bugzilla
CVE-2026-83614 kf6-breeze-icons: xmldom: Denial of Service via quadratic-time XML parsing [fedora-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83614 [HIGH] CVE-2026-83614 kf6-breeze-icons: xmldom: Denial of Service via quadratic-time XML parsing [fedora-all]
CVE-2026-83614 kf6-breeze-icons: xmldom: Denial of Service via quadratic-time XML parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart repeatedly rescans a malformed tag name to the next > during single-character recovery; in lib/dom.js, normalize() repeatedly removes and appends adjacent text nodes, caus
Bugzilla
CVE-2026-83614 kf6-breeze-icons: xmldom: Denial of Service via quadratic-time XML parsing [epel-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83614 [HIGH] CVE-2026-83614 kf6-breeze-icons: xmldom: Denial of Service via quadratic-time XML parsing [epel-all]
CVE-2026-83614 kf6-breeze-icons: xmldom: Denial of Service via quadratic-time XML parsing [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart repeatedly rescans a malformed tag name to the next > during single-character recovery; in lib/dom.js, normalize() repeatedly removes and appends adjacent text nodes, causin
Bugzilla
CVE-2026-83614 crow-translate: xmldom: Denial of Service via quadratic-time XML parsing [fedora-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83614 [HIGH] CVE-2026-83614 crow-translate: xmldom: Denial of Service via quadratic-time XML parsing [fedora-all]
CVE-2026-83614 crow-translate: xmldom: Denial of Service via quadratic-time XML parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart repeatedly rescans a malformed tag name to the next > during single-character recovery; in lib/dom.js, normalize() repeatedly removes and appends adjacent text nodes, causin
Bugzilla
CVE-2026-83614 jupyterlab: xmldom: Denial of Service via quadratic-time XML parsing [epel-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83614 [HIGH] CVE-2026-83614 jupyterlab: xmldom: Denial of Service via quadratic-time XML parsing [epel-all]
CVE-2026-83614 jupyterlab: xmldom: Denial of Service via quadratic-time XML parsing [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart repeatedly rescans a malformed tag name to the next > during single-character recovery; in lib/dom.js, normalize() repeatedly removes and appends adjacent text nodes, causing quad
Bugzilla
CVE-2026-83614 xmldom: @xmldom/xmldom: xmldom: Denial of Service via quadratic-time XML parsing
bugzilla·2026-09-01·CVSS 8.7
CVE-2026-83614 [HIGH] CVE-2026-83614 xmldom: @xmldom/xmldom: xmldom: Denial of Service via quadratic-time XML parsing
CVE-2026-83614 xmldom: @xmldom/xmldom: xmldom: Denial of Service via quadratic-time XML parsing
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart repeatedly rescans a malformed tag name to the next > during single-character recovery; in lib/dom.js, normalize() repeatedly removes and appends adjacent text nodes, causing quadratic reindexing and string rebuilding. The first path is reachable through default DOMParser.parseFromString() processing, while the second is also reachable through a direct normalize() call on a programmatically construct
https://github.com/xmldom/xmldom/commit/0748720b620555f8c222782dcab575cf0cf403b4https://github.com/xmldom/xmldom/commit/f40ccb861eee0acbf5ee4feb9a34932e87b329c9https://github.com/xmldom/xmldom/pull/1071https://github.com/xmldom/xmldom/pull/1072https://github.com/xmldom/xmldom/releases/tag/0.8.15https://github.com/xmldom/xmldom/releases/tag/0.9.12https://github.com/xmldom/xmldom/security/advisories/GHSA-93r5-fhx6-vmg9
2026-09-01
Published