CVE-2026-83614

CVE-2026-83614 is a denial-of-service vulnerability in the xmldom npm packages caused by two independent quadratic-complexity code paths (CWE-400/CWE-407) rather than memory corruption or code execution. An attacker triggers it by supplying malformed XML to the default DOMParser.parseFromString() flow, where lib/sax.js repeatedly rescans a malformed tag name to the next '>' during single-character recovery; a second path in lib/dom.js normalize() repeatedly removes and re-appends adjacent text nodes, causing quadratic reindexing, and this normalization also runs automatically via endDocument after parsing. The result is disproportionate CPU consumption on a single crafted document, enabling unauthenticated, network-reachable CPU exhaustion that denies service to the parsing process with no confidentiality or integrity impact (CVSS 4.0: 8.7, VA:H only). Any Node.js or browser application using vulnerable versions of @xmldom/xmldom (including via transitive dependencies) or the legacy xmldom package to parse attacker-controlled XML is affected. Exploitation status: no known exploitation, no public proof-of-concept, not in CISA KEV, with a modest 0.4% EPSS probability of exploitation within 30 days.

What to do: Upgrade @xmldom/xmldom to 0.8.15 (0.8.x line) or 0.9.12 (0.9.x line); there is no fixed release of the legacy xmldom package, so migrate it to @xmldom/xmldom or restrict/validate XML input size and structure. Run 'npm ls xmldom @xmldom/xmldom' (and equivalent lockfile checks) to find transitive use, and prioritize any service that parses untrusted XML from external users.