Node xmldom: From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles a mixed-case closing tag for the script, style,… (CVE-2026-83612)
Description
A vulnerability in the node-xmldom library versions up to 0.9.12 causes mishandling of mixed-case closing tags for certain HTML raw-text elements during HTML-mode parsing. This leads to unstable parser behavior and excessive CPU and memory consumption when parsing and serializing small untrusted HTML documents. The issue is fixed in version 0.9.12.
CVSS v4.0
Affected software
pkg:deb/ubuntu/node-xmldom?arch=source&distro=focalpkg:deb/ubuntu/node-xmldom?arch=source&distro=jammypkg:deb/ubuntu/node-xmldom?arch=source&distro=noblepkg:deb/ubuntu/node-xmldom?arch=source&distro=stonkingpkg:deb/ubuntu/node-xmldom?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The node-xmldom library, used for XML and HTML parsing in JavaScript, contains a flaw in versions from 0.9.0-beta.1 through 0.9.12 where the DOMParser.parseFromString() method mishandles mixed-case closing tags for script, style, textarea, or title elements. The parsing function parseHtmlSpecialContent uses a case-sensitive indexOf() call that fails to find the closing tag if it is mixed-case, resulting in a negative index and causing unstable parser progression and quadratic amplification of output size. This can cause disproportionate CPU and memory usage when processing crafted untrusted HTML input. The vulnerability is resolved in version 0.9.12 of the @xmldom/xmldom package.
Potential Impact
An attacker can supply a small crafted HTML document that triggers excessive CPU and memory consumption during parsing and serialization, potentially leading to denial of service conditions. There is no indication of code execution or data leakage from the provided information.
Mitigation Recommendations
Upgrade to @xmldom/xmldom version 0.9.12 or later, where this vulnerability is fixed. No other mitigation steps are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-83612
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 4.0
Threat ID: 6ad3f55c2cdf04f65666180d
Added to database: 10/17/2026, 22:23:24 UTC
Last enriched: 10/17/2026, 23:30:27 UTC
Last updated: 10/17/2026, 23:30:27 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.