CVE-2026-92987: roxmltree through 0.21.1 Denial of Service via Quadratic Parsing
roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single element to consume excessive CPU time and cause denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Any application using npm/roxmltree through version 0.21.1 to parse XML supplied by an attacker is exposed. The issue is remotely exploitable without authentication or user interaction when the attacker can provide XML to the parser.
What does an attacker need to send to trigger the issue?
The attacker needs to provide an XML document containing tens of thousands of attributes on a single element. Attribute and namespace validation can then consume excessive CPU because parsing time grows quadratically.
Is there a configuration limit that prevents the issue by default?
No attribute-count limit is described. The affected parser performs validation without limits on attribute count.
What can be done if updating is not immediately possible?
Restrict or reject untrusted XML inputs that contain excessive numbers of attributes on a single element before they reach roxmltree. Apply CPU or request-processing time limits to reduce the impact of expensive parsing.