CVE-2026-83617

Name of the Vulnerable Software and Affected Versions xmldom versions 0.9.11 through 0.9.11

Description The requireWellFormed: true element and attribute name checks use an anchored QName exact expression produced by the reg() function in lib/grammar.js that inherits the multiline flag. This allows a name with a valid first line followed by line terminator characters (U+000A, U+000D, U+2028, or U+2029) and breakout markup to pass validation. Consequently, this input is emitted verbatim in element start and end tags or attribute names, bypassing strict-serialization checks. The default serialization path also remains outside the strict guarantee.

Recommendations Update to version 0.9.12.