CVE-2026-83611

Name of the Vulnerable Software and Affected Versions @xmldom/xmldom versions prior to 0.8.15 @xmldom/xmldom versions prior to 0.9.12 xmldom versions 0.6.0 and earlier

Description The DOMParser.parseFromString() function can silently accept an end tag containing trailing content, such as </a junk>, which closes the element and discards the remaining content. In the 0.9.x branch, the end-tag validator in lib/sax.js inherits a multiline flag from reg(), allowing the first line to satisfy the anchored XML ETag production while failing to validate subsequent lines. This parser differential can be used to bypass a parse-before-trust well-formedness gate. The onError interface on 0.9.x and errorHandler on 0.8.x are the reporting interfaces involved.

Recommendations Update @xmldom/xmldom to version 0.8.15 or later. Update @xmldom/xmldom to version 0.9.12 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability.