Node xmldom: From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with PubidLiteral_match… (CVE-2026-83618)

xmldom is a JavaScript XML DOM parser and serializer. In versions 0.9.10 through 0.9.11 inclusive, the requireWellFormed: true serializer uses regex patterns with multiline flags to validate DocumentType.publicId and DocumentType.systemId. However, these patterns only validate the first line completely, allowing newline characters (U+000A, U+000D, U+2028, U+2029) and breakout markup to remain in the <!DOCTYPE ...> declaration. This bypasses the strict serialization mitigation intended to prevent DocumentType injection vulnerabilities. Direct property assignment remains unvalidated by design. The vulnerability is resolved in xmldom version 0.9.12.

An attacker can bypass strict serialization checks for DocumentType declarations, potentially enabling DocumentType injection attacks. This could affect XML processing security in applications using affected xmldom versions. There is no indication of known exploits in the wild. The CVSS vector indicates network attack vector, low complexity, no privileges or user interaction required, but high impact on integrity.

Upgrade to xmldom version 0.9.12 or later where this issue is fixed. No other mitigations are indicated or necessary as the fix addresses the root cause.