CVE-2026-83612: xmldom: HTML raw-text closing-tag case mismatch causes output amplification
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements. parseHtmlSpecialContent, selected by isHTMLRawTextElement or isHTMLEscapableRawTextElement, uses a case-sensitive indexOf() and then calls substring() with a missing-close result of negative one, causing unstable parser progression and quadratic output amplification. A small untrusted text/html document can consequently consume disproportionate CPU and memory when parsed and serialized. This issue is fixed in @xmldom/xmldom version 0.9.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@xmldom/xmldomto a version that resolves this vulnerability.Fixed in 0.9.12
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using @xmldom/xmldom versions from 0.9.0-beta.1 through 0.9.12 are exposed when they parse untrusted text/html with DOMParser.parseFromString() and subsequently serialize the result. The affected handling applies to script, style, textarea, and title raw-text elements.
What must an attacker provide to trigger the amplification?
An attacker needs to supply a small HTML document containing a mixed-case closing tag for an affected raw-text element. Parsing it in HTML mode can cause unstable parser progression and quadratic output amplification, consuming disproportionate CPU and memory.
Is XML parsing affected?
The issue is described in HTML-mode parsing through DOMParser.parseFromString() for untrusted text/html input. The provided information does not identify XML-mode parsing as affected.
What is the available remediation?
Update @xmldom/xmldom to version 0.9.12, which is identified as the fixed version.