Xmldom npm Package: Fifteen Parsing and Serialization Vulnerabilities Disclosed Together
A batch of fifteen vulnerabilities, mostly High severity, were disclosed in the Xmldom npm package, impacting parsing and serialization functions.
Key findings
- Fifteen vulnerabilities disclosed in Xmldom npm package on September 1, 2026.
- Multiple High severity flaws related to XML parsing and serialization vulnerabilities.
- Issues include denial of service, incorrect name validation, and improper handling of XML constructs.
- Affected versions range from 0.6.0 and earlier up to pre-release versions prior to 0.8.15 and 0.9.12.
- Patched versions are 0.8.15 and 0.9.12; immediate update recommended.
On September 1, 2026, a batch of fifteen vulnerabilities was disclosed in the Xmldom npm package, affecting various versions prior to 0.8.15 and 0.9.12. These vulnerabilities, predominantly rated High severity, stem from improper handling of XML parsing and serialization, potentially leading to denial of service, incorrect data processing, and security bypasses.
Several vulnerabilities relate to the parsing of element and attribute names. CVE-2026-83617 and CVE-2026-83611 highlight issues where name checks and end-tag parsing could be bypassed due to incorrect regular expression anchoring and multiline flag usage. Similarly, CVE-2026-83607 and CVE-2026-83605 point to flaws in Document.createElement and Element.setAttribute where unvalidated names could be accepted and serialized. CVE-2026-83613 describes how all parsed attributes were inserted via setAttributeNode, potentially leading to unexpected behavior.
Denial of service (DoS) is a significant concern, with CVE-2026-83614 detailing two independent quadratic paths in lib/sax.js that can lead to DoS conditions due to repeated rescanning. CVE-2026-83619 also contributes to DoS by trimming end-tag names with an unanchored global expression, which could lead to parsing errors.
Issues related to specific XML constructs and modes were also identified. CVE-2026-83618 and CVE-2026-83608 address improper validation of DocumentType.publicId and DocumentType.systemId when requireWellFormed is true. CVE-2026-83612 describes mishandling of mixed-case closing tags for raw-text elements during HTML-mode parsing. Furthermore, CVE-2026-83610 points out that Document.createEntityReference could accept invalid names, leading to incorrect serialization. CVE-2026-83606 details how a processing-instruction production could lead to issues with long whitespace tails.
The vulnerabilities were fixed in versions 0.8.15 and 0.9.12 of the Xmldom package. Users are strongly advised to update to these patched versions to mitigate the identified risks. The broad range of affected versions, from 0.6.0 and earlier up to the specified pre-release versions, underscores the importance of timely updates for all users of the Xmldom library. This extensive disclosure of parsing and serialization flaws emphasizes the need for robust validation in XML processing libraries.