CVE-2026-83613

Name of the Vulnerable Software and Affected Versions @xmldom/xmldom versions prior to 0.8.15 @xmldom/xmldom versions prior to 0.9.12 xmldom versions 0.6.0 and earlier

Description In the DOMHandler.startElement function within lib/dom-parser.js, every parsed attribute is inserted using setAttributeNode. Simultaneously, NamedNodeMap.setNamedItem in lib/dom.js performs a linear lookup using getNamedItem or getNamedItemNS for each insertion. Consequently, processing a well-formed element containing a large number of distinct attributes during DOMParser.parseFromString() results in quadratic comparisons, which can stall the Node.js event loop before the application can validate the input.

Recommendations Update @xmldom/xmldom to version 0.8.15 or later. Update @xmldom/xmldom to version 0.9.12 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability.