CVE-2026-83617: xmldom XML External Entity (XXE) Vulnerability

CVE-2026-83617 Overview

CVE-2026-83617 affects @xmldom/xmldom, a pure JavaScript implementation of the W3C DOM Level 2 Core DOMParser and XMLSerializer. Versions from 0.9.11 up to (but not including) 0.9.12 contain a regular expression anchoring flaw that allows attackers to bypass the requireWellFormed: true strict-serialization checks. The reg() helper in lib/grammar.js produces the QName_exact expression with the multiline (m) flag, so a name containing U+000A, U+000D, U+2028, or U+2029 followed by breakout markup passes validation. The injected content is then written verbatim into element start and end tags or attribute names, enabling XML injection [CWE-91].

Critical Impact
Attackers can inject arbitrary markup into serialized XML output despite strict validation, breaking downstream integrity guarantees for signatures, SAML assertions, and configuration payloads.

Affected Products

@xmldom/xmldom version 0.9.11
@xmldom/xmldom versions after 0.9.11 and before 0.9.12
Node.js and JavaScript applications relying on requireWellFormed: true strict serialization

Discovery Timeline

2026-09-01 - CVE-2026-83617 published to NVD
2026-09-01 - Last updated in NVD database
0.9.12 - Fix released in @xmldom/xmldom version 0.9.12

Technical Details for CVE-2026-83617

Vulnerability Analysis

The flaw exists in the reg() helper inside lib/grammar.js. That helper compiles the QName_exact regular expression used to validate element and attribute names during serialization. Because reg() sets the m (multiline) flag, the ^ and $ anchors match line boundaries rather than the start and end of the full string. An attacker-supplied name whose first line satisfies the QName grammar can therefore be followed by a line terminator and arbitrary characters — including <, >, ", and / — and still be accepted as valid.

Once validation passes, the serializer writes the entire raw string into the output. This defeats the strict-serialization checks that were previously added for earlier element-name and attribute-name injection advisories in the same library. The default (non-strict) serialization path was already outside the strict guarantee and remains vulnerable.

Root Cause

The root cause is improper anchoring of the QName validation regex. Line terminators recognized by JavaScript regex engines under the m flag (\n, \r, \\u2028, \\u2029) split the input into logical lines, and the anchored pattern matches only one of them. This is a classic multiline-anchor bypass mapped to [CWE-91] (XML Injection).

Attack Vector

An attacker who can influence element names, attribute names, or identifiers that flow into XMLSerializer with requireWellFormed: true can craft a payload such as validName\n><injected/> and have the injected markup emitted directly in the output document. Downstream consumers that trust the serialized XML — signature validators, SAML relying parties, XML-based configuration loaders — will parse the attacker-controlled structure.

javascript

// Patch: lib/grammar.js — drop the multiline flag from reg()
// Source: https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362
				return isStr ? part : part.source;
			})
			.join(''),
-		UNICODE_SUPPORT ? 'mu' : 'm'
+		UNICODE_SUPPORT ? 'u' : ''
	);
}

The fix removes the m flag so ^ and $ anchor the full string. A companion change in lib/sax.js rebuilds endTagNameStrict explicitly and reports invalid trailing characters as fatal for XML and as a warning for HTML.

Detection Methods for CVE-2026-83617

Indicators of Compromise

Serialized XML output containing element or attribute names that include embedded \n, \r, U+2028, or U+2029 followed by <, >, or / characters.
Application logs showing requireWellFormed: true calls succeeding on inputs that later produce malformed downstream parses.
Presence of @xmldom/xmldom at version 0.9.11 in package-lock.json or yarn.lock.

Detection Strategies

Run npm ls @xmldom/xmldom across build pipelines to enumerate affected dependencies, direct and transitive.
Add unit tests that pass names containing line terminators to XMLSerializer and assert the strict path throws.
Instrument serialization output with a post-check that revalidates element and attribute names against a non-multiline QName regex.

Monitoring Recommendations

Monitor SCA and SBOM tooling for the vulnerable version range and alert on new deployments that pin 0.9.11.
Track anomalies in XML signature verification and SAML assertion parsing, which are the most common consumers of strict-serialized output.
Log rejected XML documents at API gateways to catch probing traffic containing embedded line terminators inside tag or attribute names.

How to Mitigate CVE-2026-83617

Immediate Actions Required

Upgrade @xmldom/xmldom to version 0.9.12 or later in all applications and services.
Audit any code path that serializes XML with requireWellFormed: true and treats the result as trusted.
Rebuild and redeploy container images and Lambda packages that bundle the vulnerable version.

Patch Information

The issue is fixed in @xmldom/xmldom0.9.12. The patch drops the multiline flag from reg() in lib/grammar.js and tightens end-tag name validation in lib/sax.js. See the GitHub Security Advisory GHSA-jxjr-3g7g-3944, the fix commit 7b2ec67, pull request #1071, and the 0.9.12 release notes.

Workarounds

If upgrading is not immediately possible, sanitize any externally influenced element or attribute names by rejecting inputs containing \n, \r, U+2028, or U+2029 before passing them to the serializer.
Wrap XMLSerializer.serializeToString calls in a post-serialization validator that re-parses the output with a strict XML parser and fails closed on error.
Restrict the sources that can supply DOM node names to trusted, server-controlled values only.

bash

# Upgrade to the patched release
npm install @xmldom/xmldom@0.9.12

# Verify installed version
npm ls @xmldom/xmldom

# Audit for the vulnerability
npm audit --production