Node xmldom: Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of… (CVE-2026-83614)

The xmldom JavaScript library, which implements W3C XML DOM Level 2 Core standards, has two separate quadratic time complexity vulnerabilities that can lead to denial of service. The first vulnerability occurs in lib/sax.js within the parseElementStartPart function, which repeatedly rescans malformed tag names during single-character recovery. The second occurs in lib/dom.js within the normalize() function, which repeatedly removes and appends adjacent text nodes causing quadratic reindexing and string rebuilding. The first vulnerability is triggered during default DOMParser.parseFromString() processing, while the second can be triggered by calling normalize() directly on a constructed DOM or during endDocument normalization after parsing. These issues are resolved in @xmldom/xmldom versions 0.8.15 and 0.9.12. The older xmldom package versions 0.3.0 through 0.6.0 remain unpatched.

Exploitation of these vulnerabilities can cause denial of service by consuming excessive CPU resources due to quadratic time complexity in XML parsing and normalization. This can degrade application performance or cause crashes in systems using affected xmldom versions. There are no indications of privilege escalation, data disclosure, or code execution impacts.

Upgrade to @xmldom/xmldom versions 0.8.15 or 0.9.12 where the vulnerabilities are fixed. For xmldom versions 0.3.0 through 0.6.0, no fixed versions are available, so consider replacing the library or avoiding untrusted XML input. No vendor advisory or patch links are provided; verify with official sources before deployment.