CVE-2026-83613 xmldom CVE debrief

Who should care

Developers and administrators using xmldom versions prior to 0.8.15 or 0.9.12 in their Node.js applications should be aware of this vulnerability and take steps to mitigate it. This includes identifying and patching affected systems, as well as monitoring for potential performance issues.

Technical summary

The xmldom module, a pure JavaScript W3C standard-based DOMParser and XMLSerializer, is vulnerable to a performance issue that can cause Node.js event loops to stall. This occurs when parsing well-formed elements with many distinct attributes, leading to quadratic comparisons during DOMParser.parseFromString(). The issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12. The vulnerability arises from DOMHandler.startElement in lib/dom-parser.js inserting every parsed attribute through setAttributeNode, while NamedNodeMap.setNamedItem in lib/dom.js calls the linear getNamedItem or getNamedItemNS lookup for each insertion. A well-formed element with many distinct attributes therefore requires quadratic comparisons during DOMParser.parseFromString() and can stall a Node.js event loop before application validation. The vulnerability has a HIGH CVSS score of 8.7, indicating a high level of severity. Developers and administrators should identify and patch affected systems as soon as possible, and consider implementing compensating controls, such as input validation or rate limiting, until patches can be applied. The CVE record was published on 2026-09-01T15:17:39.583Z and has not been modified since then. No fixed version is available for xmldom version 0.6.0 and earlier. xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMHandler.startElement in lib/dom-parser.js inserts every parsed attribute through setAttributeNode, while NamedNodeMap.setNamedItem in lib/dom.js calls the linear getNamedItem or getNamedItemNS lookup for each insertion. A well-formed element with many distinct attributes therefore requires quadratic comparisons during DOMParser.parseFromString() and can stall a Node.js event loop before application validation. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom. The CVE record was published on 2026-09-01T15:17:39.583Z and has not been modified since then. The vulnerability has a HIGH CVSS score of 8.7, indicating a high level of severity. A fix

Defensive priority

High-priority defensive actions are recommended due to the HIGH CVSS score of 8.7. Affected systems should be identified and patched as soon as possible.

Recommended defensive actions

• Identify and inventory all systems using xmldom versions prior to 0.8.15 or 0.9.12.
• Apply patches or updates to xmldom versions 0.8.15 or 0.9.12 as soon as possible.
• Monitor Node.js event loops for potential stalls or performance issues.
• Consider implementing compensating controls, such as input validation or rate limiting, until patches can be applied.
• Review and verify the integrity of affected systems and their configurations.
• Track and document remediation progress and testing results.
• Continuously monitor for new information regarding this vulnerability and related patches.

Evidence notes

The CVE-2026-83613 issue arises in xmldom, a pure JavaScript W3C standard-based DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMHandler.startElement in lib/dom-parser.js inserts every parsed attribute through setAttributeNode, while NamedNodeMap.setNamedItem in lib/dom.js calls the linear getNamedItem or getNamedItemNS lookup for each insertion. A well-formed element with many distinct attributes therefore requires quadratic comparisons during DOMParser.parseFromString() and can stall a Node.js event loop before application validation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.