CVE-2026-83619: xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression /[ \t\n\r]+$/g. For an end tag containing a long whitespace run followed by a non-whitespace character, the expression retries from each possible starting position and backtracks quadratically before failing its end anchor. DOMParser.parseFromString() reaches the path under default options, allowing a small unauthenticated XML input to stall the Node.js event loop; the 0.9.x and unscoped npm lines do not contain this expression. This issue is fixed in @xmldom/xmldom version 0.8.15.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@xmldom/xmldomto a version that resolves this vulnerability.Fixed in 0.8.15
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the release-0.8.x parser in xmldom from 0.7.0 through versions before 0.8.15 are affected. The 0.9.x and unscoped npm lines do not contain the vulnerable expression.
Does exploitation require a non-default parser configuration or authentication?
No. DOMParser.parseFromString() reaches the vulnerable path under default options, and a small unauthenticated XML input can trigger it.
What input pattern triggers the event-loop stall?
An attacker needs to supply an XML end tag with a long run of whitespace followed by a non-whitespace character. This causes quadratic backtracking while the parser trims the captured end-tag name.
What should be done to remediate the issue?
Upgrade @xmldom/xmldom to version 0.8.15. The issue is fixed in that version.