xmldom vulnerabilities

CVEs per yearBy the year they were published

1. 20212
2. 20221
3. 202620

Newest CVEs

• CVE-2026-83619

  xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

  xmldom · xmldom

  High8.7
• CVE-2026-83618

  xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator

  xmldom · xmldom

  High8.7
• CVE-2026-83617

  xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

  xmldom · xmldom

  High8.7
• CVE-2026-83616

  xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

  xmldom · xmldom

  High8.7
• CVE-2026-83615

  xmldom: Quadratic-memory consumption

  xmldom · xmldom

  High8.7
• CVE-2026-83614

  xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

  xmldom · xmldom

  High8.7
• CVE-2026-83613

  xmldom: Quadratic-time attribute deduplication

  xmldom · xmldom

  High8.7
• CVE-2026-83612

  xmldom: HTML raw-text closing-tag case mismatch causes output amplification

  xmldom · xmldom

  High8.7
• CVE-2026-83611

  xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

  xmldom · xmldom

  Medium6.9
• CVE-2026-83610

  xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

  xmldom · xmldom

  Medium6.3