https://feed.craftedsignal.io/cpes/cpe2.3axmldom_projectxmldomnode.js/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 08 Sep 2026 21:53:02 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-09-xmldom-dos/Tue, 08 Sep 2026 21:53:02 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-xmldom-dos/The xmldom XML parser contains multiple O(n²) complexity flaws in its error-recovery path and DOM normalization logic, allowing an unauthenticated attacker to stall the Node.js event loop using crafted XML payloads.The xmldom library, commonly used for XML parsing in Node.js environments, is vulnerable to a denial of service (DoS) attack due to two distinct quadratic-time (O(n²)) complexity vulnerabilities. An attacker can supply a small, highly compressible XML document that exploits the parser's error-recovery path, leading to prolonged CPU exhaustion and event loop starvation.

The first vulnerability occurs during the parseElementStartPart process, where the parser's error-recovery mechanism performs redundant character scanning when encountering specific malformed XML inputs. The second vulnerability exists within the DOM.normalize() method, which inefficiently merges adjacent text nodes created during the parsing recovery process. These issues are reachable through the default DOMParser.parseFromString method, and the normalize() flaw is also independently accessible via the public DOM API if an application builds a tree from untrusted input. These vulnerabilities affect the entire history of the project, including current 0.8.x and 0.9.x branches.

Impact

Successful exploitation results in a persistent hang of the single-threaded Node.js event loop, preventing the application from processing any concurrent requests. Because the vulnerabilities are triggered by the default XML parser configuration and require no authentication, they represent a high risk to any service that accepts XML input from external sources. The attack is highly efficient, as payloads as small as 32 KB can cause multi-second stalls, which scale quadratically as document size increases.

Recommendation

Prioritized actions for development and security teams:

• Update all dependencies using xmldom or @xmldom/xmldom to the patched versions immediately to remediate CVE-2026-83614.
• Implement strict input size limits for any endpoint accepting XML payloads to mitigate the impact of quadratic complexity attacks.
• Audit custom code that programmatically builds DOM trees using untrusted input, ensuring that normalize() is not called on unvalidated or deeply nested structures.
• Configure DOMParser with custom error handlers to identify and reject malformed input early, rather than relying on the default error-recovery path.

]]>mediumadvisorydenial-of-servicevulnerabilityweb-applicationhttps://feed.craftedsignal.io/briefs/2026-09-xmldom-memory-exhaustion/Tue, 08 Sep 2026 21:52:54 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-xmldom-memory-exhaustion/The xmldom parser suffers from a quadratic memory complexity flaw during namespace processing, allowing unauthenticated attackers to trigger process OOM crashes using small, crafted XML payloads.The xmldom XML parser contains a vulnerability (CVE-2026-83615) stemming from inefficient namespace map handling during the parsing process. When the parser encounters an element that declares a namespace prefix, it performs a full copy of the current in-scope namespace map into a new object and retains this copy on the element while it remains open on the parse stack.

For deeply nested XML documents where each element declares a unique namespace, this mechanism leads to O(N²) memory consumption at the peak of the parse operation. Because this occurs during the initial parsing phase, it bypasses application-level security controls, such as schema validation or signature verification. An attacker can craft a small, highly compressible XML payload (less than 500 KB) that forces the parser to allocate gigabytes of heap memory, resulting in an unauthenticated denial-of-service (DoS) via OOM (Out-Of-Memory) process termination. This vulnerability affects multiple versions of both the legacy xmldom package and the current @xmldom/xmldom package.

Impact

Successful exploitation results in a full loss of service for any application utilizing vulnerable versions of xmldom to process attacker-influenced XML. Because the payload is small and highly compressible, it is effective against services that accept compressed XML over transports such as HTTP redirects or POST requests. The flaw is particularly critical for web services and middleware that parse untrusted XML before reaching authorization or authentication logic.

Recommendation

Prioritize patching all instances of xmldom and @xmldom/xmldom in your environment. Upgrade to versions that implement prototype-based namespace inheritance instead of full map cloning. Due to the nature of this memory exhaustion, traditional pattern-based WAF signatures may struggle to identify the payload; monitor process memory usage (RSS) on application servers for sudden spikes during XML parsing.

• Upgrade @xmldom/xmldom to a version newer than 0.8.14 or 0.9.11.
• Upgrade xmldom to a version newer than 0.6.0.
• Monitor application server logs for OOM crash events or unexpected restarts coinciding with high-frequency XML parsing.
• If immediate patching is not possible, implement input length and nesting depth validation before passing data to the DOMParser.

]]>mediumadvisorydenial-of-servicevulnerabilityxml