PT-2026-34616

CVE-2026-41673

Published

2026-04-22

Updated

2026-10-30

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions @xmldom/xmldom versions prior to 0.8.13 @xmldom/xmldom versions prior to 0.9.10 xmldom versions 0.6.0 and earlier

Description Seven recursive traversals in lib/dom.js operate without a depth limit. When processing a sufficiently deeply nested DOM tree, the JavaScript call stack is exhausted, resulting in a RangeError: Maximum call stack size exceeded and crashing the application. This can lead to a denial of service if a service accepts attacker-controlled XML and performs any of the affected operations.

The affected functions and entry points include

Node.prototype.normalize()
XMLSerializer.serializeToString()
Element.getElementsByTagName(), getElementsByTagNameNS(), getElementsByClassName(), and getElementById() (via the visitNode function)
Node.cloneNode(true)
Document.importNode(node, true)
node.textContent (getter)
Node.isEqualNode(other)

Recommendations Update @xmldom/xmldom to version 0.8.13 or 0.9.10. Update xmldom to a version later than 0.6.0. As a temporary workaround, restrict the use of the affected functions or limit the nesting depth of XML documents before they are processed by the library.

Exploitability

Exploit

Fix

Impacts

Researchers

Jvr2022

Karimtantawey

Praveen-Kv

Vendors

Affected products

Weakness enumeration

CWE-674: Uncontrolled Recursion