{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/@xmldom/xmldom-0.7.0--0.8.14-0.9.0--0.9.11/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:xmldom_project:xmldom:*:*:*:*:*:*:*:*","cpe:2.3:a:xmldom_project:xmldom:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"id":"CVE-2026-83614"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["xmldom (all versions)","@xmldom/xmldom (0.7.0 \u003c= 0.8.14, 0.9.0 \u003c= 0.9.11)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","vulnerability","web-application"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe \u003ccode\u003exmldom\u003c/code\u003e library, commonly used for XML parsing in Node.js environments, is vulnerable to a denial of service (DoS) attack due to two distinct quadratic-time (O(n²)) complexity vulnerabilities. An attacker can supply a small, highly compressible XML document that exploits the parser's error-recovery path, leading to prolonged CPU exhaustion and event loop starvation.\u003c/p\u003e\n\u003cp\u003eThe first vulnerability occurs during the \u003ccode\u003eparseElementStartPart\u003c/code\u003e process, where the parser's error-recovery mechanism performs redundant character scanning when encountering specific malformed XML inputs. The second vulnerability exists within the \u003ccode\u003eDOM.normalize()\u003c/code\u003e method, which inefficiently merges adjacent text nodes created during the parsing recovery process. These issues are reachable through the default \u003ccode\u003eDOMParser.parseFromString\u003c/code\u003e method, and the \u003ccode\u003enormalize()\u003c/code\u003e flaw is also independently accessible via the public DOM API if an application builds a tree from untrusted input. These vulnerabilities affect the entire history of the project, including current 0.8.x and 0.9.x branches.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a persistent hang of the single-threaded Node.js event loop, preventing the application from processing any concurrent requests. Because the vulnerabilities are triggered by the default XML parser configuration and require no authentication, they represent a high risk to any service that accepts XML input from external sources. The attack is highly efficient, as payloads as small as 32 KB can cause multi-second stalls, which scale quadratically as document size increases.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for development and security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all dependencies using \u003ccode\u003exmldom\u003c/code\u003e or \u003ccode\u003e@xmldom/xmldom\u003c/code\u003e to the patched versions immediately to remediate CVE-2026-83614.\u003c/li\u003e\n\u003cli\u003eImplement strict input size limits for any endpoint accepting XML payloads to mitigate the impact of quadratic complexity attacks.\u003c/li\u003e\n\u003cli\u003eAudit custom code that programmatically builds DOM trees using untrusted input, ensuring that \u003ccode\u003enormalize()\u003c/code\u003e is not called on unvalidated or deeply nested structures.\u003c/li\u003e\n\u003cli\u003eConfigure \u003ccode\u003eDOMParser\u003c/code\u003e with custom error handlers to identify and reject malformed input early, rather than relying on the default error-recovery path.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-08T21:53:02Z","date_published":"2026-09-08T21:53:02Z","id":"https://feed.craftedsignal.io/briefs/2026-09-xmldom-dos/","summary":"The xmldom XML parser contains multiple O(n²) complexity flaws in its error-recovery path and DOM normalization logic, allowing an unauthenticated attacker to stall the Node.js event loop using crafted XML payloads.","title":"Unauthenticated Denial of Service in xmldom via Quadratic Complexity","url":"https://feed.craftedsignal.io/briefs/2026-09-xmldom-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - @Xmldom/Xmldom (0.7.0 \u003c= 0.8.14, 0.9.0 \u003c= 0.9.11)","version":"https://jsonfeed.org/version/1.1"}