DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-83612: CVE-2026-83612: Algorithmic Complexity and Denial of Service via Output Amplification in xmldom

#security #cve #cybersecurity

CVE-2026-83612: Algorithmic Complexity and Denial of Service via Output Amplification in xmldom

Vulnerability ID: CVE-2026-83612
CVSS Score: 8.7
Published: 2026-09-08

A Denial of Service (DoS) vulnerability exists in the xmldom library when parsing HTML-mode documents with mixed-case closing tags for raw-text or escapable raw-text elements like script, style, textarea, or title. This leads to algorithmic complexity issues and quadratic output amplification during DOM serialization.

TL;DR

Unauthenticated Denial of Service via quadratic output amplification triggered by parsing HTML with case-mismatched closing raw-text tags in xmldom.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-178 / CWE-400
  • Attack Vector: Network (Unauthenticated)
  • CVSS Score: 8.7
  • EPSS Score: 0.00301 (22.45th percentile)
  • Impact: Denial of Service (CPU & Memory exhaustion)
  • Exploit Status: Proof-of-Concept Available
  • KEV Status: Not Listed

Affected Systems

  • Node.js applications using @xmldom/xmldom for HTML parsing
  • Services processing untrusted XML/HTML documents via standard DOMParser in version range 0.9.0-beta.1 to 0.9.11
  • @xmldom/xmldom: >= 0.9.0-beta.1 < 0.9.12 (Fixed in: 0.9.12)

Code Analysis

Commit: 7ced40c

fix(html): case-insensitive match for raw-text close tags

Exploit Details

Mitigation Strategies

  • Upgrade @xmldom/xmldom to version 0.9.12 or later.
  • Use package overrides to force dependencies to version 0.9.12.
  • Avoid parsing untrusted HTML documents with legacy versions of the parser.

Remediation Steps:

  1. Verify vulnerability with npm ls @xmldom/xmldom.
  2. Execute npm install @xmldom/xmldom@0.9.12 to upgrade.
  3. Add overrides to package.json if it is a transitive dependency.

References

Read the full report for CVE-2026-83612 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)