CVE-2026-83619: xmldom DOS Vulnerability in XML Parser

CVE-2026-83619 Overview

CVE-2026-83619 is a regular expression denial of service (ReDoS) vulnerability in the xmldom JavaScript library, a W3C standard-based DOM Level 2 Core DOMParser and XMLSerializer module. The flaw affects the release-0.8.x branch from version 0.7.0 through 0.8.14. An unauthenticated attacker can submit a small crafted XML document to any application calling DOMParser.parseFromString() and stall the Node.js event loop through quadratic backtracking. The issue is tracked under [CWE-400: Uncontrolled Resource Consumption] and is fixed in @xmldom/xmldom version 0.8.15.

Critical Impact
A small, unauthenticated XML payload can consume CPU indefinitely on the Node.js event loop, blocking all concurrent requests and producing a denial of service condition on the host service.

Affected Products

@xmldom/xmldom versions 0.7.0 through 0.8.14 (release-0.8.x branch)
Node.js applications using DOMParser.parseFromString() with default options
The unscoped xmldom npm package line and the 0.9.x branch are not affected

Discovery Timeline

2026-09-01 - CVE-2026-83619 published to the National Vulnerability Database
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-83619

Vulnerability Analysis

The vulnerability resides in lib/sax.js within the end-tag parsing path. The parser trims trailing whitespace from a captured end-tag name using the unanchored global regular expression /[ \t\n\r]+$/g. When the end-tag content contains a long run of whitespace followed by a non-whitespace character, the regex engine restarts from each possible starting position. Each attempt extends the [ws]+ group greedily to the end of the string, then fails the $ end anchor, causing quadratic backtracking. Because DOMParser.parseFromString() reaches this code path under default options, no authentication or special configuration is required to trigger the condition.

Root Cause

The root cause is an unanchored trailing-whitespace trim regex applied to attacker-controlled input. Anchored trims match the entire string once in linear time, but the original expression allowed the engine to explore every starting position, producing O(n²) work for inputs shaped whitespace-run + non-whitespace. This is a classic algorithmic complexity flaw where input length directly amplifies CPU consumption.

Attack Vector

An attacker sends an HTTP request or supplies input that reaches DOMParser.parseFromString(). The XML body contains an end tag such as </ … x> with a long whitespace run before a trailing non-whitespace character. The Node.js single-threaded event loop stalls while the regex backtracks, preventing the process from handling other requests until the operation completes or the process is restarted.

javascript

// Patch from lib/sax.js - anchored trim replaces vulnerable unanchored trim
// BEFORE (vulnerable):
var tagName = source.substring(tagStart + 2, end).replace(/[ \t\n\r]+$/g, '');

// AFTER (fixed): anchored trailing-whitespace trim, linear time
var tagName = source.substring(tagStart + 2, end)
    .replace(/^([\s\S]*?[^ \t\n\r])?[ \t\n\r]*$/, '$1');
// Source: https://github.com/xmldom/xmldom/commit/3abb0934f5a8a84d83a1f9cde0f2bd04c08b2a09

Detection Methods for CVE-2026-83619

Indicators of Compromise

Node.js processes exhibiting sustained 100% CPU on a single core without concurrent request throughput
HTTP request bodies containing XML end tags with unusually long internal whitespace runs followed by a non-whitespace character
Application-level timeouts and event loop lag metrics spiking after receiving XML payloads
Dependency manifests (package.json, package-lock.json) pinning @xmldom/xmldom at versions 0.7.0 through 0.8.14

Detection Strategies

Perform software composition analysis (SCA) across repositories and container images to identify vulnerable @xmldom/xmldom versions
Instrument Node.js services with event loop lag monitoring (for example, perf_hooks.monitorEventLoopDelay) and alert on sustained delays
Inspect ingress XML payloads for end tags containing whitespace runs exceeding a reasonable threshold before a trailing character

Monitoring Recommendations

Track process CPU time and event loop delay per Node.js worker and correlate with request identifiers
Log and sample XML request bodies at the API gateway to enable post-incident analysis
Alert on repeated request timeouts originating from the same source IP against endpoints that consume XML

How to Mitigate CVE-2026-83619

Immediate Actions Required

Upgrade @xmldom/xmldom to version 0.8.15 or later across all Node.js services and container images
Audit transitive dependencies using npm ls @xmldom/xmldom to locate indirect usage
Enforce request body size limits and per-request execution timeouts on endpoints that parse XML

Patch Information

The fix replaces the unanchored trim with an anchored expression that matches the entire string once, restoring linear-time behavior while preserving byte-identical output. See the GitHub Security Advisory GHSA-x4fp-j954-r2f4, the patch commit, and the v0.8.15 release notes for full remediation details.

Workarounds

Reject XML payloads exceeding a strict maximum size at the reverse proxy or API gateway before they reach the parser
Offload XML parsing to a worker thread or child process so a stalled parse does not block the main event loop
Pre-validate input by rejecting XML containing end tags with long internal whitespace runs

bash

# Upgrade to the patched release
npm install @xmldom/xmldom@0.8.15

# Verify no vulnerable versions remain in the dependency tree
npm ls @xmldom/xmldom

# Audit for known advisories
npm audit --production