CVE-2026-83606: xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.9 until 0.9.11, the processing-instruction production in lib/grammar.js lets the greedy S+ separator and lazy Char? data group repeatedly repartition a long whitespace tail when the required closing ?> is absent. Both parsePI and parseProcessingInstruction apply the expression to the entire remaining source, causing quadratic backtracking during DOMParser.parseFromString() under default options and allowing a small unauthenticated XML input to stall the Node.js event loop. This issue is fixed in @xmldom/xmldom version 0.9.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@xmldom/xmldomto a version that resolves this vulnerability.Fixed in 0.9.11
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
Applications using @xmldom/xmldom versions from 0.9.0-beta.9 through 0.9.11 that parse attacker-controlled XML with DOMParser.parseFromString() are exposed. The vulnerable parsing path is enabled under default options.
What does an attacker need to trigger the denial of service?
An attacker only needs to supply a small, unauthenticated XML document containing an unterminated processing instruction with a long whitespace tail and no closing ?>. Processing that input can cause quadratic backtracking and stall the Node.js event loop.
How can I tell whether my application is affected?
Check whether the application depends on @xmldom/xmldom in the affected version range and parses untrusted XML. Affected behavior occurs when parsing a processing instruction that lacks its required closing ?>.
What remediation is available?
Update @xmldom/xmldom to version 0.9.11, which fixes the issue.