CVE-2026-83614

Name of the Vulnerable Software and Affected Versions @xmldom/xmldom versions prior to 0.8.15 @xmldom/xmldom versions prior to 0.9.12 xmldom versions 0.3.0 through 0.6.0

Description Two independent quadratic paths can cause a denial of service. In the lib/sax.js file, the parseElementStartPart() function repeatedly rescans a malformed tag name to the next > character during single-character recovery. Additionally, in lib/dom.js, the normalize() function repeatedly removes and appends adjacent text nodes, leading to quadratic reindexing and string rebuilding. The first path is accessible via default DOMParser.parseFromString() processing, while the second is accessible through a direct normalize() call on a programmatically constructed DOM or when endDocument() invokes normalization after parsing.

Recommendations Update @xmldom/xmldom to version 0.8.15 or later. Update @xmldom/xmldom to version 0.9.12 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability.