# @xmldom/xmldom (npm) vulnerabilities 22 known vulnerabilities (1 critical, 18 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.9.12 (Aug 21, 2026): no advisory affects it - Newest unaffected release: 0.9.12 (Aug 21, 2026), the latest release - Weekly downloads: 81.5M - Dependents: 18.2K - Releases: 54 since 0.7.0 (Aug 19, 2021) - Registry: https://www.npmjs.com/package/@xmldom/xmldom - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-83619: 0.7.0 to 0.8.14 (0.8.15 is outside it) - CVE-2026-83618: 0.9.10 to 0.9.11 (0.9.12 is outside it) - CVE-2026-83617: 0.9.11 (0.9.12 is outside it) - CVE-2026-83616: 0.7.0 to 0.8.14 (0.8.15 is outside it); 0.9.0 to 0.9.11 (0.9.12 is outside it) - CVE-2026-83615: 0.7.0 to 0.8.14 (0.8.15 is outside it); 0.9.0 to 0.9.11 (0.9.12 is outside it) - CVE-2026-83614: 0.7.0 to 0.8.14 (0.8.15 is outside it); 0.9.0 to 0.9.11 (0.9.12 is outside it) - CVE-2026-83613: 0.7.0 to 0.8.14 (0.8.15 is outside it); 0.9.0 to 0.9.11 (0.9.12 is outside it) - CVE-2026-83612: 0.9.0-beta.1 to 0.9.11 (0.9.12 is outside it) - CVE-2026-83611: 0.7.0 to 0.8.14 (0.8.15 is outside it); 0.9.0 to 0.9.11 (0.9.12 is outside it) - CVE-2026-83610: 0.7.0 to 0.8.14 (0.8.15 is outside it); 0.9.0 to 0.9.11 (0.9.12 is outside it) - CVE-2026-83609: 0.9.0 to 0.9.11 (0.9.12 is outside it) - CVE-2026-83608: 0.7.0 to 0.8.14 (0.8.15 is outside it); 0.9.0 to 0.9.11 (0.9.12 is outside it) - CVE-2026-83607: 0.7.0 to 0.8.13 (0.8.14 is outside it); 0.9.0 to 0.9.10 (0.9.11 is outside it) - CVE-2026-83606: 0.9.0-beta.9 to 0.9.10 (0.9.11 is outside it) - CVE-2026-83605: 0.7.0 to 0.8.13 (0.8.14 is outside it); 0.9.0 to 0.9.10 (0.9.11 is outside it) - CVE-2026-41675: 0.7.0 to 0.8.12 (0.8.13 is outside it); 0.9.0 to 0.9.9 (0.9.10 is outside it) - CVE-2026-41674: 0.7.0 to 0.8.12 (0.8.13 is outside it); 0.9.0 to 0.9.9 (0.9.10 is outside it) - CVE-2026-41673: 0.7.0 to 0.8.12 (0.8.13 is outside it); 0.9.0 to 0.9.9 (0.9.10 is outside it) - CVE-2026-41672: 0.7.0 to 0.8.12 (0.8.13 is outside it); 0.9.0 to 0.9.9 (0.9.10 is outside it) - CVE-2026-34601: 0.7.0 to 0.8.11 (0.8.12 is outside it); 0.9.0 to 0.9.8 (0.9.9 is outside it) - CVE-2022-39353: 0.7.0 to 0.7.6 (0.7.7 is outside it); 0.8.0 to 0.8.3 (0.8.4 is outside it); 0.9.0-beta.1 to 0.9.0-beta.3 (0.9.0-beta.4 is outside it) - CVE-2021-32796: no published release is affected ## Advisories (22) ### [CVE-2026-83619](https://cve.now/CVE-2026-83619): xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser - Severity: High 8.7 - Published: Sep 1, 2026 - Affected: from 0.7.0, fixed in 0.8.15. - Fixed in 0.8.15 (released Aug 21, 2026, 11 days before disclosure). - The latest release, 0.9.12, is not affected. - 28% of @xmldom/xmldom downloads last week were affected versions (25.8M). ### [CVE-2026-83618](https://cve.now/CVE-2026-83618): xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator - Severity: High 8.7 - Published: Sep 1, 2026 - Affected: from 0.9.10, fixed in 0.9.12. - Fixed in 0.9.12 (released Aug 21, 2026, 11 days before disclosure). - The latest release, 0.9.12, is not affected. - 7.1% of @xmldom/xmldom downloads last week were affected versions (6.5M). ### [CVE-2026-83617](https://cve.now/CVE-2026-83617): xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator - Severity: High 8.7 - Published: Sep 1, 2026 - Affected: from 0.9.11, fixed in 0.9.12. - Fixed in 0.9.12 (released Aug 21, 2026, 11 days before disclosure). - The latest release, 0.9.12, is not affected. - 0.5% of @xmldom/xmldom downloads last week were affected versions (486K). ### [CVE-2026-83616](https://cve.now/CVE-2026-83616): xmldom: Processing Instruction Target Injection Bypasses requireWellFormed - Severity: High 8.7 - Published: Sep 1, 2026 - Affected: from 0.7.0, fixed in 0.8.15; from 0.9.0, fixed in 0.9.12. - Fixed in 0.8.15 (released Aug 21, 2026, 11 days before disclosure) and 0.9.12 (released Aug 21, 2026, 11 days before disclosure). - The latest release, 0.9.12, is not affected. - 37% of @xmldom/xmldom downloads last week were affected versions (34.1M). ### [CVE-2026-83615](https://cve.now/CVE-2026-83615): xmldom: Quadratic-memory consumption - Severity: High 8.7 - Published: Sep 1, 2026 - Affected: from 0.7.0, fixed in 0.8.15; from 0.9.0, fixed in 0.9.12. - Fixed in 0.8.15 (released Aug 21, 2026, 11 days before disclosure) and 0.9.12 (released Aug 21, 2026, 11 days before disclosure). - The latest release, 0.9.12, is not affected. - 37% of @xmldom/xmldom downloads last week were affected versions (34.1M). ### [CVE-2026-83614](https://cve.now/CVE-2026-83614): xmldom: Quadratic-time parsing via the malformed-input recovery path — \`parseElementStartPart\` re-scan and \`normalize()\` adjacent-text merge - Severity: High 8.7 - Published: Sep 1, 2026 - Affected: from 0.7.0, fixed in 0.8.15; from 0.9.0, fixed in 0.9.12. - Fixed in 0.8.15 (released Aug 21, 2026, 11 days before disclosure) and 0.9.12 (released Aug 21, 2026, 11 days before disclosure). - The latest release, 0.9.12, is not affected. - 37% of @xmldom/xmldom downloads last week were affected versions (34.1M). ### [CVE-2026-83613](https://cve.now/CVE-2026-83613): xmldom: Quadratic-time attribute deduplication - Severity: High 8.7 - Published: Sep 1, 2026 - Affected: from 0.7.0, fixed in 0.8.15; from 0.9.0, fixed in 0.9.12. - Fixed in 0.8.15 (released Aug 21, 2026, 11 days before disclosure) and 0.9.12 (released Aug 21, 2026, 11 days before disclosure). - The latest release, 0.9.12, is not affected. - 37% of @xmldom/xmldom downloads last week were affected versions (34.1M). ### [CVE-2026-83612](https://cve.now/CVE-2026-83612): xmldom: HTML raw-text closing-tag case mismatch causes output amplification - Severity: High 8.7 - Published: Sep 1, 2026 - Affected: from 0.9.0-beta.1, fixed in 0.9.12. - Fixed in 0.9.12 (released Aug 21, 2026, 11 days before disclosure). - The latest release, 0.9.12, is not affected. - 9% of @xmldom/xmldom downloads last week were affected versions (8.3M). ### [CVE-2026-83611](https://cve.now/CVE-2026-83611): xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content - Severity: Medium 6.9 - Published: Sep 1, 2026 - Affected: from 0.7.0, fixed in 0.8.15; from 0.9.0, fixed in 0.9.12. - Fixed in 0.8.15 (released Aug 21, 2026, 11 days before disclosure) and 0.9.12 (released Aug 21, 2026, 11 days before disclosure). - The latest release, 0.9.12, is not affected. - 37% of @xmldom/xmldom downloads last week were affected versions (34.1M). ### [CVE-2026-83610](https://cve.now/CVE-2026-83610): xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization - Severity: Medium 6.3 - Published: Sep 1, 2026 - Affected: from 0.7.0, fixed in 0.8.15; from 0.9.0, fixed in 0.9.12. - Fixed in 0.8.15 (released Aug 21, 2026, 11 days before disclosure) and 0.9.12 (released Aug 21, 2026, 11 days before disclosure). - The latest release, 0.9.12, is not affected. - 37% of @xmldom/xmldom downloads last week were affected versions (34.1M). ### [CVE-2026-83609](https://cve.now/CVE-2026-83609): xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default… - Severity: High 8.7 - Published: Sep 1, 2026 - Affected: from 0.9.0, fixed in 0.9.12. - Fixed in 0.9.12 (released Aug 21, 2026, 11 days before disclosure). - The latest release, 0.9.12, is not affected. - 9% of @xmldom/xmldom downloads last week were affected versions (8.3M). ### [CVE-2026-83608](https://cve.now/CVE-2026-83608): xmldom: DocType \`name\` Injection Bypasses requireWellFormed - Severity: High 8.7 - Published: Sep 1, 2026 - Affected: from 0.7.0, fixed in 0.8.15; from 0.9.0, fixed in 0.9.12. - Fixed in 0.8.15 (released Aug 21, 2026, 11 days before disclosure) and 0.9.12 (released Aug 21, 2026, 11 days before disclosure). - The latest release, 0.9.12, is not affected. - 37% of @xmldom/xmldom downloads last week were affected versions (34.1M). ### [CVE-2026-83607](https://cve.now/CVE-2026-83607): xmldom: Element name injection via createElement() bypasses requireWellFormed - Severity: High 8.7 - Published: Sep 1, 2026 - Affected: from 0.9.0, fixed in 0.9.11; from 0.7.0, fixed in 0.8.14. - Fixed in 0.8.14 (released Aug 12, 2026, 20 days before disclosure) and 0.9.11 (released Aug 12, 2026, 20 days before disclosure). - The latest release, 0.9.12, is not affected. - 35% of @xmldom/xmldom downloads last week were affected versions (32.8M). ### [CVE-2026-83606](https://cve.now/CVE-2026-83606): xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions - Severity: High 8.7 - Published: Sep 1, 2026 - Affected: from 0.9.0-beta.9, fixed in 0.9.11. - Fixed in 0.9.11 (released Aug 12, 2026, 20 days before disclosure). - The latest release, 0.9.12, is not affected. - 8.4% of @xmldom/xmldom downloads last week were affected versions (7.8M). ### [CVE-2026-83605](https://cve.now/CVE-2026-83605): xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed - Severity: High 8.7 - Published: Sep 1, 2026 - Affected: from 0.9.0, fixed in 0.9.11; from 0.7.0, fixed in 0.8.14. - Fixed in 0.8.14 (released Aug 12, 2026, 20 days before disclosure) and 0.9.11 (released Aug 12, 2026, 20 days before disclosure). - The latest release, 0.9.12, is not affected. - 35% of @xmldom/xmldom downloads last week were affected versions (32.8M). ### [CVE-2026-41675](https://cve.now/CVE-2026-41675): xmldom: XML node injection through unvalidated processing instruction serialization - Severity: High 8.7 - Published: May 7, 2026 - Affected: fixed in 0.8.13; from 0.9.0, fixed in 0.9.10. - Fixed in 0.8.13 (released Apr 18, 2026, 19 days before disclosure) and 0.9.10 (released Apr 18, 2026, 19 days before disclosure). - The latest release, 0.9.12, is not affected. - 20% of @xmldom/xmldom downloads last week were affected versions (18.3M). ### [CVE-2026-41674](https://cve.now/CVE-2026-41674): xmldom: XML injection through unvalidated DocumentType serialization - Severity: High 8.7 - Published: May 7, 2026 - Affected: fixed in 0.8.13; from 0.9.0, fixed in 0.9.10. - Fixed in 0.8.13 (released Apr 18, 2026, 19 days before disclosure) and 0.9.10 (released Apr 18, 2026, 19 days before disclosure). - The latest release, 0.9.12, is not affected. - 20% of @xmldom/xmldom downloads last week were affected versions (18.3M). ### [CVE-2026-41673](https://cve.now/CVE-2026-41673): xmldom: Denial of service via uncontrolled recursion in XML serialization - Severity: High 8.7 - Published: May 7, 2026 - Affected: fixed in 0.8.13; from 0.9.0, fixed in 0.9.10. - Fixed in 0.8.13 (released Apr 18, 2026, 19 days before disclosure) and 0.9.10 (released Apr 18, 2026, 19 days before disclosure). - The latest release, 0.9.12, is not affected. - 20% of @xmldom/xmldom downloads last week were affected versions (18.3M). ### [CVE-2026-41672](https://cve.now/CVE-2026-41672): xmldom: XML node injection through unvalidated comment serialization - Severity: High 8.7 - Published: May 7, 2026 - Affected: fixed in 0.8.13; from 0.9.0, fixed in 0.9.10. - Fixed in 0.8.13 (released Apr 18, 2026, 19 days before disclosure) and 0.9.10 (released Apr 18, 2026, 19 days before disclosure). - The latest release, 0.9.12, is not affected. - 20% of @xmldom/xmldom downloads last week were affected versions (18.3M). ### [CVE-2026-34601](https://cve.now/CVE-2026-34601): xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion - Severity: High 7.5 - Published: Apr 2, 2026 - Affected: fixed in 0.8.12; from 0.9.0, fixed in 0.9.9. - Fixed in 0.8.12 (released Mar 29, 2026, 4 days before disclosure) and 0.9.9 (released Mar 29, 2026, 4 days before disclosure). - The latest release, 0.9.12, is not affected. - 18% of @xmldom/xmldom downloads last week were affected versions (17M). ### [CVE-2022-39353](https://cve.now/CVE-2022-39353): xmldom allows multiple root nodes in a DOM - Severity: Critical 9.4 - Published: Nov 2, 2022 - Affected: fixed in 0.7.7; from 0.8.0, fixed in 0.8.4; from 0.9.0-beta.1, fixed in 0.9.0-beta.4. - Fixed in 0.7.7 (released Oct 29, 2022, 4 days before disclosure), 0.8.4 (released Oct 29, 2022, 4 days before disclosure) and 0.9.0-beta.4 (released Oct 29, 2022, 4 days before disclosure). - The latest release, 0.9.12, is not affected. - 0.3% of @xmldom/xmldom downloads last week were affected versions (316.5K). ### [CVE-2021-32796](https://cve.now/CVE-2021-32796): Misinterpretation of malicious XML input in xmldom - Severity: Medium 6.5 - Published: Jul 27, 2021 - Affected: fixed in 0.7.0. - Fixed in 0.7.0 (released Aug 19, 2021, 23 days after disclosure). - The latest release, 0.9.12, is not affected. - 0% of @xmldom/xmldom downloads last week were affected versions (0). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@xmldom/xmldom Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.