CVE-2026-83608: xmldom XXE Vulnerability

CVE-2026-83608 Overview

CVE-2026-83608 is an XML injection vulnerability [CWE-91] in the @xmldom/xmldom JavaScript library, a W3C standard-based DOM Level 2 Core DOMParser and XMLSerializer module. The flaw resides in the DOCUMENT_TYPE_NODE branch of lib/dom.js. Under requireWellFormed: true, the serializer validates publicId, systemId, and internalSubset but emits DocumentType.name verbatim without XML Name production checks. Attackers supply a name containing > or whitespace to terminate the <!DOCTYPE ...> declaration and inject sibling markup. The vulnerability affects @xmldom/xmldom prior to 0.8.15 and 0.9.12, and the unscoped xmldom package version 0.6.0 and earlier.

Critical Impact
Attackers can inject arbitrary XML markup into serialized documents, enabling downstream integrity attacks against consumers that trust well-formed output.

Affected Products

@xmldom/xmldom versions prior to 0.8.15
@xmldom/xmldom versions prior to 0.9.12
xmldom (unscoped legacy package) version 0.6.0 and earlier — no fix available

Discovery Timeline

2026-09-01 - CVE-2026-83608 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-83608

Vulnerability Analysis

The vulnerability sits in the strict serialization path guarded by requireWellFormed: true. The DocumentType node exposes four fields: name, publicId, systemId, and internalSubset. The serializer validates three of these against their respective XML productions (PubidLiteral, SystemLiteral, and internal subset syntax). It fails to validate name against the XML 1.0 Name production [5]. The unvalidated name value is written directly into the <!DOCTYPE ...> output.

An attacker who controls the DocumentType.name value can include the > character or whitespace to close the DOCTYPE declaration prematurely. Content following the injected > is emitted as sibling markup at the document level. This produces a well-formed-looking XML string that downstream parsers accept, breaking integrity assumptions in signing, canonicalization, or SAML/SOAP workflows.

Root Cause

WHATWG DOM declares DocumentType.name as readonly, but xmldom does not enforce this. Direct property writes to name succeed silently. The default (permissive) serialization path emits values verbatim, and the strict path forgot to add the Name-production check for name while adding it for the other three fields.

Attack Vector

Two injection channels exist. On the 0.8.x line and the unscoped xmldom package, an attacker supplies a crafted name argument to document.implementation.createDocumentType(). On every affected line, an attacker can write directly to the DocumentType.name property. Serialization with requireWellFormed: true then emits the malicious string without rejection.

javascript

// Security patch in lib/dom.js — validates DocumentType.name against
// the XML Name production under requireWellFormed: true.
// Source: https://github.com/xmldom/xmldom/commit/85f12eb4d14b44de33216cfb72b50af4d24e9fdd
/**
 * Represents a DocumentType node (the `<!DOCTYPE ...>` declaration).
 *
 * `name`, `publicId`, `systemId`, and `internalSubset` are plain own-property assignments.
 * xmldom does not enforce the `readonly` constraint declared by the WHATWG DOM spec —
 * direct property writes succeed silently. Values are serialized verbatim when
 * `requireWellFormed` is false (the default). When the serializer is invoked with
 * `requireWellFormed: true` (via the 4th-parameter options object), it validates each
 * field — including `name`, which is checked against the XML `Name` production — and throws
 * `DOMException` with code `INVALID_STATE_ERR` on invalid values.
 */
function DocumentType() {
};

Detection Methods for CVE-2026-83608

Indicators of Compromise

Serialized XML output containing multiple root-level elements after a <!DOCTYPE ...> declaration, indicating declaration termination via injected >.
DocumentType.name values containing whitespace, >, <, &, or characters outside the XML Name production.
Runtime DOMException errors with code INVALID_STATE_ERR originating from xmldom serialization after patching.

Detection Strategies

Perform Software Composition Analysis (SCA) to identify @xmldom/xmldom versions below 0.8.15 or 0.9.12 and any use of the deprecated unscoped xmldom package.
Instrument application logs to capture DocumentType.name values passed to createDocumentType() or assigned via direct property writes.
Add post-serialization validation that re-parses xmldom output and confirms exactly one root node and one DOCTYPE.

Monitoring Recommendations

Monitor build pipelines and dependency manifests (package.json, package-lock.json) for pinned vulnerable versions.
Alert on outbound XML payloads containing DOCTYPE names with non-Name characters in SAML, SOAP, and XML-DSig flows.
Track exceptions and error rates from XML serialization routines after patch deployment to identify attacker probes.

How to Mitigate CVE-2026-83608

Immediate Actions Required

Upgrade @xmldom/xmldom to version 0.8.15 or 0.9.12 immediately.
Migrate away from the unscoped xmldom package; no fix is available for the 0.6.0 line.
Audit application code for any path that accepts external input into createDocumentType() or writes to DocumentType.name.
Reject or sanitize DocumentType.name values against the XML 1.0 Name production before serialization.

Patch Information

Maintainers released fixes in GitHub Release 0.8.15 and GitHub Release 0.9.12. The fix commits 57aec90 and 85f12eb add Name production validation to the strict serialization path. See GHSA-27p8-2357-5qqv and pull requests #1071 and #1072 for full details.

Workarounds

Validate all DocumentType.name values against the XML Name production before invoking the serializer.
Reject untrusted input that reaches createDocumentType() or DocumentType.name writes.
Wrap XMLSerializer output with a re-parse step to confirm a single root element and DOCTYPE.

bash

# Upgrade to a patched release using npm
npm install @xmldom/xmldom@^0.9.12
# Or for the 0.8.x line
npm install @xmldom/xmldom@^0.8.15
# Verify the installed version
npm ls @xmldom/xmldom