npmPackage

@xmldom/xmldom

22 known vulnerabilities (1 critical, 18 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release: 0.9.12 (Aug 21, 2026): no advisory affects it
Newest unaffected release: 0.9.12 (Aug 21, 2026), the latest release
Advisories: 22 · 1 critical, 18 high, 3 medium

Weekly downloads: 81.5M
Dependents: 18.2K
Releases: 54 since 0.7.0 (Aug 19, 2021)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-83619
Affects 0.7.0 to 0.8.14 (0.8.15 is outside it)
CVE-2026-83618
Affects 0.9.10 to 0.9.11 (0.9.12 is outside it)
CVE-2026-83617
Affects 0.9.11 (0.9.12 is outside it)
CVE-2026-83616
Affects 0.7.0 to 0.8.14 (0.8.15 is outside it); 0.9.0 to 0.9.11 (0.9.12 is outside it)
CVE-2026-83615
Affects 0.7.0 to 0.8.14 (0.8.15 is outside it); 0.9.0 to 0.9.11 (0.9.12 is outside it)
CVE-2026-83614
Affects 0.7.0 to 0.8.14 (0.8.15 is outside it); 0.9.0 to 0.9.11 (0.9.12 is outside it)
CVE-2026-83613
Affects 0.7.0 to 0.8.14 (0.8.15 is outside it); 0.9.0 to 0.9.11 (0.9.12 is outside it)
CVE-2026-83612
Affects 0.9.0-beta.1 to 0.9.11 (0.9.12 is outside it)
CVE-2026-83611
Affects 0.7.0 to 0.8.14 (0.8.15 is outside it); 0.9.0 to 0.9.11 (0.9.12 is outside it)
CVE-2026-83610
Affects 0.7.0 to 0.8.14 (0.8.15 is outside it); 0.9.0 to 0.9.11 (0.9.12 is outside it)
CVE-2026-83609
Affects 0.9.0 to 0.9.11 (0.9.12 is outside it)
CVE-2026-83608
Affects 0.7.0 to 0.8.14 (0.8.15 is outside it); 0.9.0 to 0.9.11 (0.9.12 is outside it)

Show all 22 advisoriesShow fewer advisories

CVE-2026-83607
Affects 0.7.0 to 0.8.13 (0.8.14 is outside it); 0.9.0 to 0.9.10 (0.9.11 is outside it)
CVE-2026-83606
Affects 0.9.0-beta.9 to 0.9.10 (0.9.11 is outside it)
CVE-2026-83605
Affects 0.7.0 to 0.8.13 (0.8.14 is outside it); 0.9.0 to 0.9.10 (0.9.11 is outside it)
CVE-2026-41675
Affects 0.7.0 to 0.8.12 (0.8.13 is outside it); 0.9.0 to 0.9.9 (0.9.10 is outside it)
CVE-2026-41674
Affects 0.7.0 to 0.8.12 (0.8.13 is outside it); 0.9.0 to 0.9.9 (0.9.10 is outside it)
CVE-2026-41673
Affects 0.7.0 to 0.8.12 (0.8.13 is outside it); 0.9.0 to 0.9.9 (0.9.10 is outside it)
CVE-2026-41672
Affects 0.7.0 to 0.8.12 (0.8.13 is outside it); 0.9.0 to 0.9.9 (0.9.10 is outside it)
CVE-2026-34601
Affects 0.7.0 to 0.8.11 (0.8.12 is outside it); 0.9.0 to 0.9.8 (0.9.9 is outside it)
CVE-2022-39353
Affects 0.7.0 to 0.7.6 (0.7.7 is outside it); 0.8.0 to 0.8.3 (0.8.4 is outside it); 0.9.0-beta.1 to 0.9.0-beta.3 (0.9.0-beta.4 is outside it)
CVE-2021-32796
No published release is affected
No published release is affected

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 22

CVE-2026-83619High 8.7
xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser
Affected: from 0.7.0, fixed in 0.8.15.
Fixed in 0.8.15 (released Aug 21, 2026, 11 days before disclosure).
The latest release, 0.9.12, is not affected.
28% of @xmldom/xmldom downloads last week were affected versions (25.8M).
CVE-2026-83618High 8.7
xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
Affected: from 0.9.10, fixed in 0.9.12.
Fixed in 0.9.12 (released Aug 21, 2026, 11 days before disclosure).
The latest release, 0.9.12, is not affected.
7.1% of @xmldom/xmldom downloads last week were affected versions (6.5M).
CVE-2026-83617High 8.7
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
Affected: from 0.9.11, fixed in 0.9.12.
Fixed in 0.9.12 (released Aug 21, 2026, 11 days before disclosure).
The latest release, 0.9.12, is not affected.
0.5% of @xmldom/xmldom downloads last week were affected versions (486K).
CVE-2026-83616High 8.7
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
Affected: from 0.7.0, fixed in 0.8.15; from 0.9.0, fixed in 0.9.12.
Fixed in 0.8.15 (released Aug 21, 2026, 11 days before disclosure) and 0.9.12 (released Aug 21, 2026, 11 days before disclosure).
The latest release, 0.9.12, is not affected.
37% of @xmldom/xmldom downloads last week were affected versions (34.1M).
CVE-2026-83615High 8.7
xmldom: Quadratic-memory consumption
Affected: from 0.7.0, fixed in 0.8.15; from 0.9.0, fixed in 0.9.12.
Fixed in 0.8.15 (released Aug 21, 2026, 11 days before disclosure) and 0.9.12 (released Aug 21, 2026, 11 days before disclosure).
The latest release, 0.9.12, is not affected.
37% of @xmldom/xmldom downloads last week were affected versions (34.1M).
CVE-2026-83614High 8.7
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
Affected: from 0.7.0, fixed in 0.8.15; from 0.9.0, fixed in 0.9.12.
Fixed in 0.8.15 (released Aug 21, 2026, 11 days before disclosure) and 0.9.12 (released Aug 21, 2026, 11 days before disclosure).
The latest release, 0.9.12, is not affected.
37% of @xmldom/xmldom downloads last week were affected versions (34.1M).
CVE-2026-83613High 8.7
xmldom: Quadratic-time attribute deduplication
Affected: from 0.7.0, fixed in 0.8.15; from 0.9.0, fixed in 0.9.12.
Fixed in 0.8.15 (released Aug 21, 2026, 11 days before disclosure) and 0.9.12 (released Aug 21, 2026, 11 days before disclosure).
The latest release, 0.9.12, is not affected.
37% of @xmldom/xmldom downloads last week were affected versions (34.1M).
CVE-2026-83612High 8.7
xmldom: HTML raw-text closing-tag case mismatch causes output amplification
Affected: from 0.9.0-beta.1, fixed in 0.9.12.
Fixed in 0.9.12 (released Aug 21, 2026, 11 days before disclosure).
The latest release, 0.9.12, is not affected.
9% of @xmldom/xmldom downloads last week were affected versions (8.3M).
CVE-2026-83611Medium 6.9
xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content
Affected: from 0.7.0, fixed in 0.8.15; from 0.9.0, fixed in 0.9.12.
Fixed in 0.8.15 (released Aug 21, 2026, 11 days before disclosure) and 0.9.12 (released Aug 21, 2026, 11 days before disclosure).
The latest release, 0.9.12, is not affected.
37% of @xmldom/xmldom downloads last week were affected versions (34.1M).
CVE-2026-83610Medium 6.3
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
Affected: from 0.7.0, fixed in 0.8.15; from 0.9.0, fixed in 0.9.12.
Fixed in 0.8.15 (released Aug 21, 2026, 11 days before disclosure) and 0.9.12 (released Aug 21, 2026, 11 days before disclosure).
The latest release, 0.9.12, is not affected.
37% of @xmldom/xmldom downloads last week were affected versions (34.1M).
CVE-2026-83609High 8.7
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default…
Affected: from 0.9.0, fixed in 0.9.12.
Fixed in 0.9.12 (released Aug 21, 2026, 11 days before disclosure).
The latest release, 0.9.12, is not affected.
9% of @xmldom/xmldom downloads last week were affected versions (8.3M).
CVE-2026-83608High 8.7
xmldom: DocType `name` Injection Bypasses requireWellFormed
Affected: from 0.7.0, fixed in 0.8.15; from 0.9.0, fixed in 0.9.12.
Fixed in 0.8.15 (released Aug 21, 2026, 11 days before disclosure) and 0.9.12 (released Aug 21, 2026, 11 days before disclosure).
The latest release, 0.9.12, is not affected.
37% of @xmldom/xmldom downloads last week were affected versions (34.1M).
CVE-2026-83607High 8.7
xmldom: Element name injection via createElement() bypasses requireWellFormed
Affected: from 0.9.0, fixed in 0.9.11; from 0.7.0, fixed in 0.8.14.
Fixed in 0.8.14 (released Aug 12, 2026, 20 days before disclosure) and 0.9.11 (released Aug 12, 2026, 20 days before disclosure).
The latest release, 0.9.12, is not affected.
35% of @xmldom/xmldom downloads last week were affected versions (32.8M).
CVE-2026-83606High 8.7
xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
Affected: from 0.9.0-beta.9, fixed in 0.9.11.
Fixed in 0.9.11 (released Aug 12, 2026, 20 days before disclosure).
The latest release, 0.9.12, is not affected.
8.4% of @xmldom/xmldom downloads last week were affected versions (7.8M).
CVE-2026-83605High 8.7
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
Affected: from 0.9.0, fixed in 0.9.11; from 0.7.0, fixed in 0.8.14.
Fixed in 0.8.14 (released Aug 12, 2026, 20 days before disclosure) and 0.9.11 (released Aug 12, 2026, 20 days before disclosure).
The latest release, 0.9.12, is not affected.
35% of @xmldom/xmldom downloads last week were affected versions (32.8M).

Show all 22 advisoriesShow fewer advisories

CVE-2026-41675High 8.7
xmldom: XML node injection through unvalidated processing instruction serialization
Affected: fixed in 0.8.13; from 0.9.0, fixed in 0.9.10.
Fixed in 0.8.13 (released Apr 18, 2026, 19 days before disclosure) and 0.9.10 (released Apr 18, 2026, 19 days before disclosure).
The latest release, 0.9.12, is not affected.
20% of @xmldom/xmldom downloads last week were affected versions (18.3M).
CVE-2026-41674High 8.7
xmldom: XML injection through unvalidated DocumentType serialization
Affected: fixed in 0.8.13; from 0.9.0, fixed in 0.9.10.
Fixed in 0.8.13 (released Apr 18, 2026, 19 days before disclosure) and 0.9.10 (released Apr 18, 2026, 19 days before disclosure).
The latest release, 0.9.12, is not affected.
20% of @xmldom/xmldom downloads last week were affected versions (18.3M).
CVE-2026-41673High 8.7
xmldom: Denial of service via uncontrolled recursion in XML serialization
Affected: fixed in 0.8.13; from 0.9.0, fixed in 0.9.10.
Fixed in 0.8.13 (released Apr 18, 2026, 19 days before disclosure) and 0.9.10 (released Apr 18, 2026, 19 days before disclosure).
The latest release, 0.9.12, is not affected.
20% of @xmldom/xmldom downloads last week were affected versions (18.3M).
CVE-2026-41672High 8.7
xmldom: XML node injection through unvalidated comment serialization
Affected: fixed in 0.8.13; from 0.9.0, fixed in 0.9.10.
Fixed in 0.8.13 (released Apr 18, 2026, 19 days before disclosure) and 0.9.10 (released Apr 18, 2026, 19 days before disclosure).
The latest release, 0.9.12, is not affected.
20% of @xmldom/xmldom downloads last week were affected versions (18.3M).
CVE-2026-34601High 7.5
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
Affected: fixed in 0.8.12; from 0.9.0, fixed in 0.9.9.
Fixed in 0.8.12 (released Mar 29, 2026, 4 days before disclosure) and 0.9.9 (released Mar 29, 2026, 4 days before disclosure).
The latest release, 0.9.12, is not affected.
18% of @xmldom/xmldom downloads last week were affected versions (17M).
CVE-2022-39353Critical 9.4
xmldom allows multiple root nodes in a DOM
Affected: fixed in 0.7.7; from 0.8.0, fixed in 0.8.4; from 0.9.0-beta.1, fixed in 0.9.0-beta.4.
Fixed in 0.7.7 (released Oct 29, 2022, 4 days before disclosure), 0.8.4 (released Oct 29, 2022, 4 days before disclosure) and 0.9.0-beta.4 (released Oct 29, 2022, 4 days before disclosure).
The latest release, 0.9.12, is not affected.
0.3% of @xmldom/xmldom downloads last week were affected versions (316.5K).
CVE-2021-32796Medium 6.5
Misinterpretation of malicious XML input in xmldom
Affected: fixed in 0.7.0.
Fixed in 0.7.0 (released Aug 19, 2021, 23 days after disclosure).
The latest release, 0.9.12, is not affected.
0% of @xmldom/xmldom downloads last week were affected versions (0).