REDHAT-BUG-2467630: High severity npm/@xmldom/xmldom vulnerability

Q: What input would an attacker need to trigger the crash?

The attacker would need to cause the application to process a sufficiently deeply nested DOM tree. The recursive traversals in lib/dom.js can then exceed the JavaScript call stack limit and raise a RangeError.

Q: Which package versions are affected and which versions contain the fix?

The issue affects xmldom 0.6.0 and earlier, plus @xmldom/xmldom releases before 0.8.13 and releases from 0.9.0 through 0.9.9. Fixed versions are @xmldom/xmldom 0.8.13 and 0.9.10.

Q: What is the expected impact if exploitation succeeds?

Processing the maliciously deep DOM tree can cause a RangeError: Maximum call stack size exceeded and crash the application.

Published May 7, 2026

Updated

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

Affected Software

2 affected components

npm/@xmldom/xmldom<0.9.10, <0.8.13

npm/xmldom=0.6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade @xmldom/xmldom to a version that resolves this vulnerability.
Fixed in 0.9.10
Upgrade
Upgrade @xmldom/xmldom to a version that resolves this vulnerability.
Fixed in 0.8.13

Event History

May 7, 2026

Data Sourced

via Red Hat·05:02 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What input would an attacker need to trigger the crash?

The attacker would need to cause the application to process a sufficiently deeply nested DOM tree. The recursive traversals in lib/dom.js can then exceed the JavaScript call stack limit and raise a RangeError.

Which package versions are affected and which versions contain the fix?

The issue affects xmldom 0.6.0 and earlier, plus @xmldom/xmldom releases before 0.8.13 and releases from 0.9.0 through 0.9.9. Fixed versions are @xmldom/xmldom 0.8.13 and 0.9.10.

What is the expected impact if exploitation succeeds?

Processing the maliciously deep DOM tree can cause a RangeError: Maximum call stack size exceeded and crash the application.

REDHAT-BUG-2467630: High severity npm/@xmldom/xmldom vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What input would an attacker need to trigger the crash?

Which package versions are affected and which versions contain the fix?

What is the expected impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What input would an attacker need to trigger the crash?

Which package versions are affected and which versions contain the fix?

What is the expected impact if exploitation succeeds?