CVE-2026-83613: xmldom Library DOS Vulnerability

CVE-2026-83613 Overview

CVE-2026-83613 is an algorithmic complexity vulnerability in @xmldom/xmldom, a pure JavaScript W3C standard-based DOMParser and XMLSerializer module. The flaw resides in DOMHandler.startElement within lib/dom-parser.js, which inserts every parsed attribute through setAttributeNode. Each insertion triggers a linear getNamedItem or getNamedItemNS lookup inside NamedNodeMap.setNamedItem in lib/dom.js. A well-formed element containing many distinct attributes forces quadratic comparisons during DOMParser.parseFromString(). Attackers can send crafted XML to stall the Node.js event loop before application-level validation runs. The issue is categorized under [CWE-407: Inefficient Algorithmic Complexity].

Critical Impact
Remote unauthenticated attackers can trigger a denial-of-service condition by submitting a single XML document that consumes the Node.js event loop through O(M²) attribute processing.

Affected Products

@xmldom/xmldom versions prior to 0.8.15
@xmldom/xmldom versions prior to 0.9.12
xmldom version 0.6.0 and earlier (no fixed version available)

Discovery Timeline

2026-09-01 - CVE-2026-83613 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-83613

Vulnerability Analysis

The defect lives in the parse-time attribute de-duplication path. When DOMHandler.startElement processes an element, it forwards every attribute to setAttributeNode, which delegates to NamedNodeMap.setNamedItem. That method must verify that the attribute name is not already present before inserting, and it does so with a linear scan of the existing entries. For an element with M attributes, the parser performs M insertions and each insertion scans up to M-1 previous entries, producing O(M²) comparisons. The parsing work runs synchronously on the Node.js event loop, so a sufficiently attribute-heavy element blocks all other request handling on the process until the parse completes.

Root Cause

The root cause is the absence of a constant-time membership structure inside NamedNodeMap. The list was the sole authority for both attribute order and name lookup, so every membership check required a full traversal. XML permits well-formed elements with a very large number of distinct attributes, which turns a routine parse into a computationally expensive operation.

Attack Vector

An unauthenticated network attacker submits an XML payload to any endpoint that calls DOMParser.parseFromString(). Because the input is syntactically well-formed, upstream validation such as schema checks does not run until after parsing, which is where the delay occurs. Repeated submissions can hold the Node.js event loop and produce sustained denial of service without any authentication or user interaction.

javascript

// Security patch in lib/dom.js
// Adds a two-level null-prototype membership index so setNamedItem
// resolves an existing attribute in O(1) instead of scanning the list.
function NamedNodeMap() {
	// namespaceURI (non-empty string) -> (localName -> Attr)
	this._nsIndex = Object.create(null);
	// localName -> Attr, for the null / empty-string namespace
	this._noNsIndex = Object.create(null);
}
// Source: https://github.com/xmldom/xmldom/commit/cfb09b5dbeb035fdfedc9f01e2bbaf226bf47cf3

Detection Methods for CVE-2026-83613

Indicators of Compromise

Sudden spikes in Node.js CPU utilization correlated with inbound XML payloads.
Event loop lag or blocked async handlers during requests that invoke DOMParser.parseFromString().
HTTP request bodies containing single elements with hundreds or thousands of distinct attribute names.
Increased latency or timeout errors on endpoints that accept XML from untrusted sources.

Detection Strategies

Inspect application dependency manifests for xmldom or @xmldom/xmldom versions older than 0.8.15 and 0.9.12.
Add ingress inspection rules that flag XML documents with element attribute counts above a safe threshold.
Instrument Node.js runtimes with event-loop latency metrics and alert on prolonged synchronous stalls.

Monitoring Recommendations

Log per-request parse duration for any handler that calls DOMParser.parseFromString() and alert on outliers.
Track process-level CPU and heap growth patterns aligned with XML request volume.
Correlate WAF telemetry on XML content types with backend response-time regressions.

How to Mitigate CVE-2026-83613

Immediate Actions Required

Upgrade @xmldom/xmldom to version 0.8.15 or 0.9.12 in all Node.js applications and transitive dependencies.
Remove the unmaintained xmldom package (0.6.0 and earlier), which has no fixed version, and migrate to @xmldom/xmldom.
Enforce request size and attribute-count limits at the reverse proxy or API gateway for XML content types.

Patch Information

Fixes are available in GitHub Release 0.8.15 and GitHub Release 0.9.12. The corrective commits introduce a null-prototype membership index so setNamedItem resolves duplicates in O(1). Review GitHub Pull Request #1071, GitHub Pull Request #1072, and GitHub Security Advisory GHSA-8344-3jmq-59r6 for full technical context.

Workarounds

Reject XML payloads whose element attribute counts exceed a conservative application-specific limit before invoking the parser.
Offload XML parsing to a worker thread so a stalled parse does not block the main event loop.
Apply strict request timeouts on endpoints that accept XML from untrusted callers.

bash

# Configuration example: upgrade the vulnerable dependency
npm install @xmldom/xmldom@0.9.12
# or, for the 0.8.x line
npm install @xmldom/xmldom@0.8.15
npm ls xmldom @xmldom/xmldom