CVE-2026-83611: xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString() can silently accept an end tag such as </a\njunk>, close the element, and discard the trailing content. On 0.9.x, the lib/sax.js end-tag validator inherits the multiline flag from reg(), allowing the first line to satisfy the anchored XML ETag production; older lines have no equivalent residue validation. This parser differential can bypass a parse-before-trust well-formedness gate, although it does not inject the discarded content; onError on 0.9.x and errorHandler on 0.8.x are the relevant reporting interfaces. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@xmldom/xmldomto a version that resolves this vulnerability.Fixed in 0.8.15 - Upgrade
Upgrade
@xmldom/xmldomto a version that resolves this vulnerability.Fixed in 0.9.12 - Configuration
Enable/implement the relevant parser error reporting interface so that malformed/non-well-formed end tags (e.g., </a\njunk>) are detected: use onError for 0.9.x and errorHandler for 0.8.x.
xmldom DOMParser.parseFromString() onError (0.9.x) / errorHandler (0.8.x) = ensure errors are reported and handled (do not ignore parser errors)
Event History
Frequently Asked Questions
Which deployments are affected?
Affected releases are @xmldom/xmldom before 0.8.15 and before 0.9.12, plus xmldom 0.6.0 and earlier. The issue is fixed in @xmldom/xmldom 0.8.15 and 0.9.12; no fixed version is available for xmldom.
What must an attacker control to exploit this behavior?
An attacker needs to supply XML that is processed by DOMParser.parseFromString(), including a malformed end tag whose name is followed by a line break and trailing content, such as </a\njunk>. The risk is relevant where successful parsing is used as a well-formedness check before the XML is trusted or acted upon.
Does the malformed trailing content become part of the parsed document?
No. The parser closes the element and discards the trailing content; the issue is a parser differential that can bypass a parse-before-trust well-formedness gate, not content injection.
How can applications detect malformed input while upgrading?
On 0.9.x, use the onError reporting interface; on 0.8.x, use errorHandler. These are the relevant interfaces for reporting parsing errors.