CVE-2026-83613: xmldom: Quadratic-time attribute deduplication
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMHandler.startElement in lib/dom-parser.js inserts every parsed attribute through setAttributeNode, while NamedNodeMap.setNamedItem in lib/dom.js calls the linear getNamedItem or getNamedItemNS lookup for each insertion. A well-formed element with many distinct attributes therefore requires quadratic comparisons during DOMParser.parseFromString() and can stall a Node.js event loop before application validation. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@xmldom/xmldomto a version that resolves this vulnerability.Fixed in 0.8.15 - Upgrade
Upgrade
@xmldom/xmldomto a version that resolves this vulnerability.Fixed in 0.9.12
Event History
Frequently Asked Questions
Which deployments are realistically exposed to denial of service?
Applications that parse attacker-controlled or otherwise untrusted XML with DOMParser.parseFromString() are exposed. A single well-formed XML element containing many distinct attributes can stall the Node.js event loop before application-level validation runs.
What must an attacker provide to trigger the issue?
The attacker needs to cause the application to parse a well-formed XML document containing an element with many distinct attributes. No malformed XML is required.
Are fixed versions available for all affected package lines?
Fixed releases are available for @xmldom/xmldom 0.8.15 and 0.9.12. No fixed version is available for the xmldom package; version 0.6.0 and earlier are affected.
What can be done if an immediate upgrade is not possible?
Avoid parsing untrusted XML with the affected parser, or reject inputs with excessive attribute counts before they reach DOMParser.parseFromString(). Application validation after parsing does not prevent the event-loop stall.