Node xmldom: Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENT_TYPE_NODE branch in lib/dom.js validates… (CVE-2026-83608)

The node-xmldom library, a JavaScript XML DOM parser and serializer, has a vulnerability in the handling of DocumentType nodes. Specifically, prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENT_TYPE_NODE branch in lib/dom.js validates publicId, systemId, and internalSubset under requireWellFormed: true but emits DocumentType.name verbatim without enforcing XML Name constraints. If the DocumentType.name contains characters such as '>' or whitespace, it can prematurely terminate the <!DOCTYPE ...> declaration and inject sibling markup. This value can be set via createDocumentType() or by directly writing to the DocumentType.name property. The default and legacy behaviors remain permissive, while the strict path fails to enforce proper XML Name validation. The vulnerability is addressed in @xmldom/xmldom versions 0.8.15 and 0.9.12. No fix is available for xmldom 0.6.0 and earlier.

This vulnerability allows an attacker to inject sibling markup by manipulating the DocumentType.name property, potentially leading to malformed XML documents or injection of unintended markup. This could affect applications relying on xmldom for XML parsing and serialization, possibly impacting XML processing integrity. No known exploits are reported in the wild.

A fix is available in @xmldom/xmldom versions 0.8.15 and 0.9.12. Users of these packages should upgrade to these versions or later. For xmldom version 0.6.0 and earlier, no fixed version is available; consider migrating to the maintained @xmldom/xmldom package and upgrading to a patched version. No other vendor advisories or temporary mitigations are provided.