CVE-2026-83612

Name of the Vulnerable Software and Affected Versions xmldom versions 0.9.0-beta.1 through 0.9.11

Description HTML-mode parsing through the DOMParser.parseFromString() function mishandles mixed-case closing tags for raw-text elements such as script, style, textarea, or title. The parseHtmlSpecialContent function, which is selected by isHTMLRawTextElement or isHTMLEscapableRawTextElement, utilizes a case-sensitive indexOf() method. When a closing tag is not found, it returns a negative one, which is then passed to substring(), leading to unstable parser progression and quadratic output amplification. Consequently, a small untrusted text/html document can cause disproportionate CPU and memory consumption during parsing and serialization.

Recommendations Update to version 0.9.12.