CVE-2026-83613

CVE-2026-83613 is an algorithmic complexity denial-of-service flaw (CWE-407) in the xmldom XML parser for Node.js. When DOMParser.parseFromString() processes a well-formed element containing many distinct attributes, DOMHandler.startElement inserts each attribute via setAttributeNode, and NamedNodeMap.setNamedItem performs a linear getNamedItem/getNamedItemNS lookup per insertion, producing quadratic work. An attacker who can supply crafted XML can therefore stall the Node.js event loop and exhaust CPU, causing denial of service; per the CVSS 4.0 vector the impact is availability only (VA:H, no confidentiality or integrity impact). Any application in the npm ecosystem parsing untrusted XML with affected versions is exposed: the legacy xmldom package at version 0.6.0 and earlier (no fixed release available) and @xmldom/xmldom prior to 0.8.15 and prior to 0.9.12. No public proof-of-concept, CISA KEV listing, or reported in-the-wild exploitation is known; EPSS estimates only a 0.3% probability of exploitation in the next 30 days.

What to do: Upgrade @xmldom/xmldom to 0.8.15 or 0.9.12 (or the latest 0.9.x release); for the legacy xmldom package no patched version exists, so migrate to @xmldom/xmldom. Until patched, restrict or sanitize untrusted XML before parsing, cap the number of attributes per element, or move parsing into a worker/child process so a crafted document cannot stall the main event loop. Audit package-lock files and dependency trees for xmldom/@xmldom/xmldom to identify affected deployments.