Node xmldom: Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString() can silently accept an end… (CVE-2026-83611)

xmldom is a JavaScript XML DOM parser and serializer. Versions prior to @xmldom/xmldom 0.8.15 and 0.9.12, and xmldom 0.6.0 and earlier, have a vulnerability in DOMParser.parseFromString() where malformed end tags such as </a\njunk> are silently accepted, closing the element and discarding trailing content. This behavior bypasses parse-before-trust well-formedness validation gates but does not result in injection of discarded content. The issue arises due to the lib/sax.js end-tag validator inheriting a multiline flag that allows the first line to satisfy the XML end tag production, while older lines lack residue validation. Relevant error reporting interfaces are onError (0.9.x) and errorHandler (0.8.x). The vulnerability is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12. No fix is available for xmldom 0.6.0 and earlier.

This vulnerability allows bypassing of XML well-formedness checks by silently accepting malformed end tags and discarding trailing content. While this does not inject or execute malicious content, it may cause applications relying on strict XML parsing to trust malformed XML inputs incorrectly, potentially leading to logic errors or security policy bypasses. No known exploits are reported in the wild.

Upgrade to @xmldom/xmldom versions 0.8.15 or 0.9.12 or later, where this issue is fixed. For xmldom 0.6.0 and earlier, no fixed version is available; consider replacing the library or implementing additional XML validation controls. No vendor advisory is provided, so check relevant package repositories for updates.