CVE-2026-83614— xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
Quick assessment
Affected
xmldom xmldom
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
xmldom 是一个纯 JavaScript 实现的模块，基于 W3C 标准（XML DOM 2 级核心）提供了 DOMParser 和 XMLSerializer 功能。在 @xmldom/xmldom 版本 0.8.15 和 0.9.12 之前，以及 xmldom 从 0.3.0 到 0.6.0 的版本中，存在两条独立的二次方时间复杂度的处理路径，可能导致拒绝服务（DoS）问题。 具体而言： 在 中的 函数在单字符恢复过程中，会对格式错误的标签名反复扫描直到遇到下一个 ，导致时间复杂度呈二次方增长。 在 中的
Possible ATT&CK Techniques 1 AI
T1020 · Automated Exfiltration
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-83614
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
Source: CVE Program / CVE List V5
Vulnerability Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart repeatedly rescans a malformed tag name to the next > during single-character recovery; in lib/dom.js, normalize() repeatedly removes and appends adjacent text nodes, causing quadratic reindexing and string rebuilding. The first path is reachable through default DOMParser.parseFromString() processing, while the second is also reachable through a direct normalize() call on a programmatically constructed DOM, and endDocument invokes that normalization after parsing. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-83614
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-83614
请登录查看更多情报信息。
Other References for CVE-2026-83614 (7)
-
https://github.com/xmldom/xmldom/pull/1071 x_refsource_MISC
-
https://github.com/xmldom/xmldom/pull/1072 x_refsource_MISC
-
https://github.com/xmldom/xmldom/releases/tag/0.8.15 x_refsource_MISC
-
https://github.com/xmldom/xmldom/releases/tag/0.9.12 x_refsource_MISC
-
https://github.com/xmldom/xmldom/security/advisories/GHSA-93r5-fhx6-vmg9 x_refsource_CONFIRM
Same Patch Batch · xmldom · 2026-09-01 · 10 CVEs total
| CVE-2026-83605 | 8.7 HIGH | xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed |
| CVE-2026-83606 | 8.7 HIGH | xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructi |
| CVE-2026-83607 | 8.7 HIGH | xmldom: Element name injection via createElement() bypasses requireWellFormed |
| CVE-2026-83609 | 8.7 HIGH | xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line termina |
| CVE-2026-83613 | 8.7 HIGH | xmldom: Quadratic-time attribute deduplication |
| CVE-2026-83612 | 8.7 HIGH | xmldom: HTML raw-text closing-tag case mismatch causes output amplification |
| CVE-2026-83608 | 8.7 HIGH | xmldom: DocType `name` Injection Bypasses requireWellFormed |
| CVE-2026-83611 | 6.9 MEDIUM | xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line |
| CVE-2026-83610 | 6.3 MEDIUM | xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellForm |
IV. Related Vulnerabilities
Same product: xmldom
-
CVE-2026-83613
xmldom: Quadratic-time attribute deduplication -
CVE-2026-83612
xmldom: HTML raw-text closing-tag case mismatch causes outpu -
CVE-2026-83611
xmldom: Parser silently accepts a not-well-formed end tag wh -
CVE-2026-83610
xmldom: XML fragment injection via invalid EntityReference.n -
CVE-2026-83609
xmldom: Creation-time XML Name/QName validation is bypassabl
Same vendor: xmldom
-
CVE-2026-83613
xmldom: Quadratic-time attribute deduplication -
CVE-2026-83612
xmldom: HTML raw-text closing-tag case mismatch causes outpu -
CVE-2026-83611
xmldom: Parser silently accepts a not-well-formed end tag wh -
CVE-2026-83610
xmldom: XML fragment injection via invalid EntityReference.n -
CVE-2026-83609
xmldom: Creation-time XML Name/QName validation is bypassabl
Same weakness: CWE-400
-
CVE-2026-83606
xmldom PI grammar regex ReDoS: quadratic backtracking on unt -
CVE-2026-82743
Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while a -
CVE-2026-82742
Ash.Filter.Runtime materializes a combinatorial cross-produc -
CVE-2026-82735
Match regex runs on over-length input in Ash.Type.String, en -
CVE-2026-82397
Tornado: Urlencoded body parsing omits max_num_fields, so on
V. Comments for CVE-2026-83614
No comments yet