Node xmldom: Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMHandler.startElement in lib/dom-parser.js inserts… (CVE-2026-83613)

The node-xmldom library, a JavaScript XML DOM parser and serializer, has a performance vulnerability in DOMHandler.startElement within lib/dom-parser.js. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, each attribute parsed is inserted via setAttributeNode, which triggers a linear search in NamedNodeMap.setNamedItem for each insertion. This results in quadratic comparisons when parsing elements with many distinct attributes, potentially stalling the Node.js event loop during DOMParser.parseFromString(). The issue is resolved in @xmldom/xmldom versions 0.8.15 and 0.9.12. No fixed version exists for xmldom 0.6.0 and earlier.

Applications using affected versions of node-xmldom may experience significant performance degradation or event loop stalls when parsing XML elements with many attributes. This can lead to denial of service conditions by blocking the Node.js event loop before application-level validation occurs. There is no indication of code execution or data corruption from this issue.

Upgrade to @xmldom/xmldom versions 0.8.15 or 0.9.12 or later to resolve this performance issue. For xmldom version 0.6.0 and earlier, no fixed version is available; consider migrating to the maintained @xmldom/xmldom package and applying the fixed versions. Monitor XML input sizes and attribute counts to reduce risk of event loop stalls until upgrade is possible.