CVE-2026-83619

Name of the Vulnerable Software and Affected Versions xmldom versions 0.7.0 through 0.8.14

Description The parser in lib/sax.js uses an unanchored global regular expression /[ t r]+$/g to trim captured end-tag names. When an end tag contains a long sequence of whitespace followed by a non-whitespace character, the expression causes quadratic backtracking. This allows an unauthenticated user to provide a small XML input to the DOMParser.parseFromString() function that can stall the Node.js event loop, leading to a denial of service.

Recommendations Update to version 0.8.15 or later.