CVE-2026-83619

A regular-expression denial-of-service (ReDoS) flaw, tracked as CWE-1333 and CWE-400, exists in the @xmldom/xmldom npm package: from version 0.7.0 through versions before 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names using the unanchored global expression /[ \t\n\r]+$/g, which backtracks quadratically when an end tag contains a long whitespace run followed by a non-whitespace character. An attacker reaches this path by passing a small, crafted XML document to DOMParser.parseFromString() under default options, so a single unauthenticated request can stall the Node.js event loop. The impact is availability only (CVSS 4.0 VA:H with no confidentiality or integrity effects): the host application or service becomes unresponsive while the event loop is blocked. Any Node.js application that parses attacker-controlled XML with an affected 0.7.x-0.8.x release is exposed, including installs where the package arrives as a transitive dependency, while the 0.9.x line and the unscoped xmldom npm package are unaffected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS estimates only about a 0.3% probability of exploitation within 30 days.

What to do: Upgrade @xmldom/xmldom to 0.8.15 or later, or migrate to the unaffected 0.9.x line; audit dependency trees (e.g., with npm ls) for transitive uses pinned to 0.7.x-0.8.x and update them as well. As interim mitigation, apply request timeouts and size limits on XML-parsing endpoints and consider rejecting or pre-processing untrusted XML containing long whitespace runs in end tags. The issue is availability-only, so monitor for event-loop stalls rather than data compromise.