Node xmldom: From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QName_exact expression produced by reg() in… (CVE-2026-83617)

xmldom is a JavaScript module implementing W3C XML DOM Level 2 Core standards. Between versions 0.9.11 and 0.9.12, the requireWellFormed: true option uses a regular expression with the multiline flag for element and attribute name validation. This allows names with a valid first line followed by newline characters (U+000A, U+000D, U+2028, or U+2029) to pass validation incorrectly, bypassing strict serialization checks introduced in prior advisories. As a result, malformed element start/end tags or attribute names can be emitted verbatim. The vulnerability is resolved in version 0.9.12.

This vulnerability allows bypassing strict XML serialization checks, which may lead to malformed XML documents being generated. The CVSS vector indicates network attack vector, low attack complexity, no privileges or user interaction required, no confidentiality or availability impact, but high integrity impact. This suggests an attacker could inject or manipulate XML element or attribute names to affect data integrity. No known exploits are reported in the wild.

Upgrade to xmldom version 0.9.12 or later, where this issue is fixed. No other mitigation or temporary workaround is indicated.