CVE-2026-41673— xmldom: Denial of service via uncontrolled recursion in XML serialization

EPSS 0.08% · P24 Updated May 07, 2026

Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-41673

AIGC Shenlong Model
NVD (National Vulnerability Database)

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

xmldom: Denial of service via uncontrolled recursion in XML serialization

Source: NVD (National Vulnerability Database)

Vulnerability Description

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

Source: NVD (National Vulnerability Database)

CVSS Information

N/A

Source: NVD (National Vulnerability Database)

Vulnerability Type

未经控制的递归

Source: NVD (National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
xmldom	xmldom	xmldom <= 0.6.0	-

II. Public POCs for CVE-2026-41673

#	POC Description	Source Link	Shenlong Link

AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-41673

Please Login to view more intelligence information

Release 0.9.10 · xmldom/xmldom · GitHubx_refsource_MISC
Release 0.8.13 · xmldom/xmldom · GitHubx_refsource_MISC
Denial of service via uncontrolled recursion in XML serialization · Advisory · xmldom/xmldom · GitHubx_refsource_CONFIRM
refactor: migrate textContent getter to walkDOM · xmldom/xmldom@8834218 · GitHubx_refsource_MISC
fix: make walkDOM iterative to prevent stack overflow (GHSA-2v35-w6hq… · xmldom/xmldom@e6edcab · GitHubx_refsource_MISC
refactor: migrate importNode to walkDOM · xmldom/xmldom@2912574 · GitHubx_refsource_MISC
refactor: migrate serializeToString to walkDOM · xmldom/xmldom@17678a2 · GitHubx_refsource_MISC
refactor: migrate _visitNode to walkDOM · xmldom/xmldom@8b7cfd1 · GitHubx_refsource_MISC
fix: prevent stack overflow in normalize (GHSA-2v35-w6hq-6mfw) · xmldom/xmldom@430357c · GitHubx_refsource_MISC
fix: prevent stack overflow in isEqualNode (GHSA-2v35-w6hq-6mfw) · xmldom/xmldom@4845ef1 · GitHubx_refsource_MISC
refactor: migrate cloneNode to walkDOM · xmldom/xmldom@b062038 · GitHubx_refsource_MISC
refactor: introduce recursive walkDOM · xmldom/xmldom@2d6d691 · GitHubx_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2026-41673

IV. Related Vulnerabilities

Same product: xmldom

Same vendor: xmldom

Same weakness: CWE-674

V. Comments for CVE-2026-41673

No comments yet

Leave a comment