CVE-2026-83615: xmldom JavaScript Library DOS Vulnerability

CVE-2026-83615 Overview

CVE-2026-83615 is a resource exhaustion vulnerability in the @xmldom/xmldom and legacy xmldom JavaScript packages. The flaw resides in the appendElement function within lib/sax.js, which flat-copies the entire currentNSMap for every nested element that declares a new namespace prefix. This behavior produces quadratic memory growth relative to XML nesting depth, allowing a small, highly compressible XML payload to exhaust the Node.js heap before application-level validation runs. The issue affects @xmldom/xmldom versions prior to 0.8.15 and 0.9.12, and legacy xmldom versions 0.1.5 through 0.6.0. The weakness is classified as [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact
A remote, unauthenticated attacker can submit a crafted XML document to any endpoint that parses input with xmldom, exhausting process memory and causing denial of service.

Affected Products

@xmldom/xmldom versions prior to 0.8.15
@xmldom/xmldom versions prior to 0.9.12
Legacy xmldom versions 0.1.5 through 0.6.0 (no fixed version available)

Discovery Timeline

2026-09-01 - CVE-2026-83615 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-83615

Vulnerability Analysis

The vulnerability lives in the SAX parser path used by xmldom's DOMParser. When the parser encounters an element that declares a new XML namespace prefix, appendElement invokes _copy(currentNSMap, currentNSMap = {}) to clone every ancestor prefix mapping into a fresh flat object. Each nested scope repeats this operation, retaining a full snapshot of ancestor mappings on the parse stack.

For a document nesting N scopes that each declare a prefix, total namespace-map storage grows as sum(1..N) = O(N^2) rather than O(N). XML is highly compressible, so an attacker can encode deeply nested elements in a very small request body, yet force the parser to allocate hundreds of megabytes of retained map entries. Node.js hits the V8 heap limit and crashes the worker process before the application performs any input validation.

Root Cause

The root cause is unbounded resource allocation during namespace-scope tracking. The parser used flat object copies to keep own-property enumeration clean for the endPrefixMapping callback, but did so at every scope transition rather than sharing ancestor state through inheritance.

Attack Vector

Exploitation requires only network reachability to any service that feeds attacker-controlled XML into xmldom. No authentication, user interaction, or prior privilege is required. Common exposure includes SAML assertion consumers, SOAP endpoints, RSS/Atom ingestion, XML-RPC handlers, and XMPP components.

javascript

// Patch in lib/sax.js - replaces flat copy with prototype-chain inheritance
		if (localNSMap == null) {
			localNSMap = Object.create(null);
-			_copy(currentNSMap, (currentNSMap = Object.create(null)));
+			// Derive the child scope's namespace map by prototype-chain inheritance
+			// instead of a flat copy: lookups inherit ancestor prefixes transparently,
+			// so a document nesting N scopes retains O(N) map entries rather than
+			// sum(1..N) = O(N^2). `localNSMap` stays a flat own-only record of the
+			// prefixes declared at THIS element, so own-property enumeration
+			// (endPrefixMapping below) still reports only local declarations.
+			currentNSMap = Object.create(currentNSMap);
		}
		currentNSMap[nsPrefix] = localNSMap[nsPrefix] = value;
		a.uri = NAMESPACE.XMLNS;
// Source: https://github.com/xmldom/xmldom/commit/dabffe884e864eeecb1f515c716f875e1bc47ec1

Detection Methods for CVE-2026-83615

Indicators of Compromise

Node.js worker processes terminating with FATAL ERROR: Reached heap limit Allocation failed or JavaScript heap out of memory shortly after receiving XML input.
Sudden RSS or heap growth in services that call new DOMParser().parseFromString() on external input.
HTTP request bodies containing deeply nested XML elements with repeated xmlns: prefix declarations at every level.

Detection Strategies

Inventory application dependencies for xmldom and @xmldom/xmldom at versions below 0.8.15 or 0.9.12 using npm ls, SBOM scans, or software composition analysis tools.
Alert on parser processes exceeding baseline memory thresholds followed by unexpected restarts, correlated with inbound XML traffic.
Deploy WAF rules that flag XML payloads with unusually high element nesting depth or per-element namespace declaration counts.

Monitoring Recommendations

Track heap utilization and out-of-memory exit codes on Node.js services parsing XML, exporting metrics to a centralized observability platform.
Log request size, parse duration, and element depth for XML-accepting endpoints to establish anomaly baselines.
Monitor CVE feeds and GitHub Security Advisory GHSA-965w-775f-mr7g for updates.

How to Mitigate CVE-2026-83615

Immediate Actions Required

Upgrade @xmldom/xmldom to version 0.8.15 or 0.9.12 or later across all applications and transitive dependencies.
For legacy xmldom (0.1.5 through 0.6.0), migrate to @xmldom/xmldom since no fixed version exists for the legacy package.
Enforce request size limits and XML nesting-depth caps at the reverse proxy or API gateway ahead of the parser.

Patch Information

The fix replaces the flat _copy of the ancestor namespace map with prototype-chain inheritance via Object.create(currentNSMap). Local declarations remain own-properties on the child scope, preserving endPrefixMapping semantics while reducing retained memory from O(N^2) to O(N). See GitHub Release 0.8.15, GitHub Release 0.9.12, and Pull Request #1072.

Workarounds

Cap inbound XML body size at the load balancer or middleware layer to a value appropriate for the application.
Pre-validate XML depth and total element count before invoking DOMParser, rejecting documents that exceed defined thresholds.
Isolate XML parsing in a worker with a bounded --max-old-space-size so an OOM crash does not take down the primary process.

bash

# Upgrade to the patched release and audit for transitive usage
npm install @xmldom/xmldom@^0.9.12
npm ls @xmldom/xmldom xmldom

# Run Node.js XML workers with a bounded heap to contain OOM impact
node --max-old-space-size=512 xml-worker.js