{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/@xmldom/xmldom--0.7.0--0.8.14/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:xmldom_project:xmldom:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"id":"CVE-2026-83615"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["xmldom (\u003e= 0.1.5, \u003c= 0.6.0)","@xmldom/xmldom (\u003e= 0.7.0, \u003c= 0.8.14)","@xmldom/xmldom (\u003e= 0.9.0, \u003c= 0.9.11)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","vulnerability","xml"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe xmldom XML parser contains a vulnerability (CVE-2026-83615) stemming from inefficient namespace map handling during the parsing process. When the parser encounters an element that declares a namespace prefix, it performs a full copy of the current in-scope namespace map into a new object and retains this copy on the element while it remains open on the parse stack.\u003c/p\u003e\n\u003cp\u003eFor deeply nested XML documents where each element declares a unique namespace, this mechanism leads to O(N²) memory consumption at the peak of the parse operation. Because this occurs during the initial parsing phase, it bypasses application-level security controls, such as schema validation or signature verification. An attacker can craft a small, highly compressible XML payload (less than 500 KB) that forces the parser to allocate gigabytes of heap memory, resulting in an unauthenticated denial-of-service (DoS) via OOM (Out-Of-Memory) process termination. This vulnerability affects multiple versions of both the legacy xmldom package and the current @xmldom/xmldom package.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a full loss of service for any application utilizing vulnerable versions of xmldom to process attacker-influenced XML. Because the payload is small and highly compressible, it is effective against services that accept compressed XML over transports such as HTTP redirects or POST requests. The flaw is particularly critical for web services and middleware that parse untrusted XML before reaching authorization or authentication logic.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize patching all instances of xmldom and @xmldom/xmldom in your environment. Upgrade to versions that implement prototype-based namespace inheritance instead of full map cloning. Due to the nature of this memory exhaustion, traditional pattern-based WAF signatures may struggle to identify the payload; monitor process memory usage (RSS) on application servers for sudden spikes during XML parsing.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@xmldom/xmldom\u003c/code\u003e to a version newer than 0.8.14 or 0.9.11.\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003exmldom\u003c/code\u003e to a version newer than 0.6.0.\u003c/li\u003e\n\u003cli\u003eMonitor application server logs for OOM crash events or unexpected restarts coinciding with high-frequency XML parsing.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, implement input length and nesting depth validation before passing data to the DOMParser.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-08T21:52:54Z","date_published":"2026-09-08T21:52:54Z","id":"https://feed.craftedsignal.io/briefs/2026-09-xmldom-memory-exhaustion/","summary":"The xmldom parser suffers from a quadratic memory complexity flaw during namespace processing, allowing unauthenticated attackers to trigger process OOM crashes using small, crafted XML payloads.","title":"Denial of Service via Quadratic Memory Consumption in xmldom","url":"https://feed.craftedsignal.io/briefs/2026-09-xmldom-memory-exhaustion/"}],"language":"en","title":"CraftedSignal Threat Feed - @Xmldom/Xmldom (\u003e= 0.7.0, \u003c= 0.8.14)","version":"https://jsonfeed.org/version/1.1"}