CVE-2026-83615: xmldom: Quadratic-memory consumption
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.1.5 through 0.6.0, appendElement in lib/sax.js uses copy to clone the complete currentNSMap for each nested element that declares a new namespace prefix. Keeping every ancestor map live on the parse stack creates quadratic peak namespace-map storage, so a small highly compressible XML document can exhaust the process heap before application validation. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@xmldom/xmldomto a version that resolves this vulnerability.Fixed in 0.8.15 - Upgrade
Upgrade
@xmldom/xmldomto a version that resolves this vulnerability.Fixed in 0.9.12
Event History
Frequently Asked Questions
Which package versions are affected and which updates resolve the issue?
For @xmldom/xmldom, versions before 0.8.15 and versions before 0.9.12 in the respective release lines are affected; updating to 0.8.15 or 0.9.12 resolves the issue. For xmldom, versions 0.1.5 through 0.6.0 are affected, and no fixed version is available.
What input is required to trigger excessive memory use?
An attacker needs XML that contains deeply nested elements, with each nested element declaring a new namespace prefix. The document can be small and highly compressible while still causing quadratic peak namespace-map storage during parsing.
When does the memory exhaustion occur relative to application validation?
It occurs during XML parsing, before application-level validation can run. Applications that parse attacker-controlled XML may therefore exhaust the process heap before their own validation or policy checks reject the document.