CVE-2026-83612

@xmldom/xmldom versions 0.9.0-beta.1 through 0.9.11 mishandle a mixed-case closing tag for the HTML raw-text elements script, style, textarea, and title during HTML-mode parsing via DOMParser.parseFromString(): parseHtmlSpecialContent uses a case-sensitive indexOf() and then calls substring() with a not-found result of -1, causing unstable parser progression and quadratic output amplification (CWE-178, CWE-400). An attacker triggers this by inducing an application to parse and serialize a small, crafted untrusted text/html document. The result is disproportionate CPU and memory consumption, i.e., a denial-of-service impact; the CVSS 4.0 vector (VA:H, all C/I impacts none) indicates no confidentiality or integrity loss. Any Node.js or browser application with a direct or transitive npm dependency on a vulnerable @xmldom/xmldom version is affected. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS estimates only a 0.3% probability of exploitation in the next 30 days.

What to do: Upgrade @xmldom/xmldom to 0.9.12 or later, including transitive copies (audit with 'npm ls @xmldom/xmldom' or your lockfile scanner). As interim mitigation, avoid parsing untrusted text/html with vulnerable versions, or cap input size and enforce CPU/time limits around parsing and serialization. Applications parsing only non-HTML XML are not exposed to this specific flaw, and no in-the-wild exploitation has been reported.