Threat database

The Node.js xmldom library versions prior to @xmldom/xmldom 0.8.15 and 0.9.12, and xmldom 0.6.0 and earlier, contain a parsing issue where DOMParser.parseFromString() can silently accept malformed end tags, discarding trailing content without error. This flaw allows bypassing of well-formedness checks but does not inject discarded content. The issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fix exists for xmldom 0.6.0 and earlier. The vulnerability has a medium severity rating based on CVSS 4.0 metrics and does not have known exploits in the wild.

A vulnerability in the node-xmldom library versions up to 0.9.12 causes mishandling of mixed-case closing tags for certain HTML raw-text elements during HTML-mode parsing. This leads to unstable parser behavior and excessive CPU and memory consumption when parsing and serializing small untrusted HTML documents. The issue is fixed in version 0.9.12.

A performance issue exists in node-xmldom prior to versions 0.8.15 and 0.9.12, and in version 0.6.0 and earlier, where parsing elements with many attributes causes quadratic time complexity in attribute insertion. This can stall the Node.js event loop during XML parsing before application validation. The issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fix is available for xmldom 0.6.0 and earlier.

Node xmldom versions prior to @xmldom/xmldom 0.8.15 and 0.9.12, and xmldom versions 0.3.0 through 0.6.0, contain two independent quadratic complexity issues that can cause denial of service. These issues arise from repeated rescanning of malformed tag names and repeated removal and appending of adjacent text nodes during normalization. The vulnerabilities affect XML parsing and normalization functions, leading to potential resource exhaustion. Fixes are available in @xmldom/xmldom versions 0.8.15 and 0.9.12. No fixed versions exist for the older xmldom package.

The Node.js xmldom library versions prior to @xmldom/xmldom 0.8.15 and 0.9.12, and xmldom versions 0.1.5 through 0.6.0, contain a vulnerability in the appendElement function in lib/sax.js. This function uses _copy to clone the current namespace map for each nested element declaring a new namespace prefix, causing quadratic growth in namespace-map storage. This can lead to heap exhaustion when parsing small, highly compressible XML documents, potentially causing denial of service. The issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fix is available for xmldom. Several specific affected package versions are identified.

A vulnerability in the node-xmldom library versions prior to @xmldom/xmldom 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, allows injection of XML structure via unvalidated targets in Document.createProcessingInstruction. This occurs because the serializer does not properly validate the target string, enabling malformed processing instructions that can break XML boundaries. Fixed versions exist for @xmldom/xmldom but not for xmldom.

The Node.js xmldom library versions from 0.9.11 up to but not including 0.9.12 contain a vulnerability in the requireWellFormed: true element and attribute name validation. This flaw allows certain newline characters to bypass strict serialization checks, potentially leading to malformed XML output. The issue is fixed in version 0.9.12.

The Node.js xmldom library versions from 0.9.10 up to but not including 0.9.12 contain a vulnerability in the requireWellFormed: true serializer. This serializer improperly validates DocumentType.publicId and DocumentType.systemId, allowing certain newline characters and breakout markup to bypass strict serialization checks. This flaw can lead to DocumentType injection despite prior mitigations. The issue is fixed in version 0.9.12.

A flaw in the Node.js HTTP client can cause request desynchronization in Node.js-based forwarding proxies that rebuild outbound headers from visible IncomingMessage headers while reusing backend connections. This occurs because Node.js may omit headers beyond configured limits from user-visible header collections but still use those omitted headers internally for HTTP message framing, potentially hiding headers like Content-Length from userland. This affects all supported Node.js release lines including versions 22, 24, and 26. The CVSS score is 3.7, indicating medium severity.

Pypdf2 versions prior to 6.15.0 contain a vulnerability where an attacker can craft a PDF that causes excessive processing time due to inefficient handling of long runs of non-whitespace bytes in the read_until_whitespace function. This results in a denial of service via resource exhaustion. The issue is fixed in version 6.15.0.

A heap-based buffer overflow vulnerability exists in the amf_string_new function of FLVMeta up to version 1.2.2. The issue arises from improper manipulation of the argument length, which can be triggered remotely. Although an exploit has been publicly disclosed, the project maintainer questions the practical exploitability of this vulnerability. A patch addressing this issue is available.

A null pointer dereference vulnerability exists in FLVMeta up to version 1.2.2 in the amf_object_get function within the AMF Object Parsing component. This vulnerability can be triggered remotely and causes a denial of service due to application crash. Although a patch is available, the project maintainer questions the exploitability of this issue. The CVSS score is 4.3, indicating medium severity.

hw/virtio-rng: Fix host use-after-free

hw/uefi: short VarCheckPolicy REGISTER request causes heap-buffer-overflow in uefi-vars

hw/uefi: non-NUL variable policy name causes heap-buffer-overflow in print_policy_entry()

libvduse: validate vq size

hw/uefi: add post_load checks

hw/uefi: account variable policy entries against storage size

hw/uefi: check lower limit for signature list size

virtio-scsi: fix SCSIRequest leak on a bad request