Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-83606— xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

Quick assessment

Affected

xmldom xmldom

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

xmldom是xmldom组织的一个提供XML文档DOM解析功能的前端组件库。 xmldom 0.9.0-beta.9至0.9.11之前版本存在资源管理错误漏洞，该漏洞源于lib/grammar.js中的处理指令存在二次回溯问题，可能导致未经身份验证的XML输入使Node.js事件循环停滞，造成拒绝服务。

CVSS 8.7 · High EPSS 0.52% · P44 Updated Sep 01, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 2

Vendor	Product	Version Range	Status
@xmldom	xmldom	`>= 0.9.0-beta.9, < 0.9.11`	affected
xmldom	xmldom	`>= 0.9.0-beta.9, < 0.9.11`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-83606

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

Source: CVE Program / CVE List V5

Vulnerability Description

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.9 until 0.9.11, the processing-instruction production in lib/grammar.js lets the greedy S+ separator and lazy Char*? data group repeatedly repartition a long whitespace tail when the required closing ?> is absent. Both parsePI and parseProcessingInstruction apply the expression to the entire remaining source, causing quadratic backtracking during DOMParser.parseFromString() under default options and allowing a small unauthenticated XML input to stall the Node.js event loop. This issue is fixed in @xmldom/xmldom version 0.9.11.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

未加控制的资源消耗(资源穷尽)

Source: CVE Program / CVE List V5

Vulnerability Title

xmldom 资源管理错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
xmldom	xmldom	>= 0.9.0-beta.9, < 0.9.11	-
@xmldom	xmldom	>= 0.9.0-beta.9, < 0.9.11	-

II. Public POCs for CVE-2026-83606

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-83606

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-83606 (2)

Vendor Advisories for CVE-2026-83606 (1)

🔗 PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions · Advisory · xmldom/xmldom · GitHub Read full article x_refsource_CONFIRM

Vendor Pages for CVE-2026-83606 (1)

🔗 Release 0.9.11 · xmldom/xmldom · GitHub Read full article x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-83606

Same Patch Batch · xmldom · 2026-09-01 · 15 CVEs total

CVE-2026-83605	8.7 HIGH	xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
CVE-2026-83607	8.7 HIGH	xmldom: Element name injection via createElement() bypasses requireWellFormed
CVE-2026-83609	8.7 HIGH	xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line termina
CVE-2026-83613	8.7 HIGH	xmldom: Quadratic-time attribute deduplication
CVE-2026-83612	8.7 HIGH	xmldom: HTML raw-text closing-tag case mismatch causes output amplification
CVE-2026-83614	8.7 HIGH	xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartP
CVE-2026-83608	8.7 HIGH	xmldom: DocType `name` Injection Bypasses requireWellFormed
CVE-2026-83617	8.7 HIGH	xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded
CVE-2026-83615	8.7 HIGH	xmldom: Quadratic-memory consumption
CVE-2026-83619	8.7 HIGH	xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag
CVE-2026-83618	8.7 HIGH	xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedd
CVE-2026-83616	8.7 HIGH	xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
CVE-2026-83611	6.9 MEDIUM	xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line
CVE-2026-83610	6.3 MEDIUM	xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellForm

IV. Related Vulnerabilities

Same product: xmldom

Same vendor: xmldom

Same weakness: CWE-400