CVE-2026-83606

@xmldom/xmldom, a pure-JavaScript W3C-standard DOMParser/XMLSerializer module on npm, contains a quadratic-backtracking regular-expression flaw (ReDoS, CWE-1333/CWE-400) in its processing-instruction grammar. When the required closing ?> terminator is absent, the greedy S+ separator and lazy Char*? data group repeatedly repartition a long whitespace tail, and because parsePI and parseProcessingInstruction apply the expression to the entire remaining source, DOMParser.parseFromString() under default options suffers quadratic backtracking. An unauthenticated attacker who can submit crafted XML — a small input containing a whitespace-heavy, unterminated processing instruction — to any application or endpoint that parses untrusted XML with an affected version can stall the Node.js event loop, denying service to the entire process. All consumers of @xmldom/xmldom from 0.9.0-beta.9 up to but not including 0.9.11 are affected; the impact is availability-only (CVSS 4.0 VA:H with no confidentiality or integrity impact), and versions prior to 0.9.0-beta.9 are outside the affected range. Exploitation has not been observed: there is no public PoC, the CVE is not in CISA KEV, and EPSS assigns only a 0.3% probability of exploitation in the next 30 days.

What to do: Upgrade to @xmldom/xmldom 0.9.11 or later, and audit lockfiles, SBOMs and transitive dependency trees (e.g., npm ls @xmldom/xmldom) for versions 0.9.0-beta.9 through 0.9.10. Until patched, avoid parsing attacker-supplied XML with affected versions, or apply request-size limits, parser timeouts, and input checks that reject unterminated, whitespace-heavy processing instructions. Treat this as an availability-only risk: no data exposure is expected, but a successful DoS stalls the whole Node.js process, so prioritize fixes for internet-facing XML-parsing endpoints.