- Latest release
- 0.6.0 (Apr 17, 2021): affected by 16 advisories
- Newest unaffected release
- Every release is affected by at least one advisory
- Advisories
- 17 · 1 critical, 12 high, 4 medium
- Weekly downloads
- 1.8M
- Dependents
- 2,016
- Releases
- 36 since 0.1.0 (Jan 6, 2012)
- Registry
- npm
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-83616Affects 0.1.0 to 0.6.0 (through the newest release)
- CVE-2026-83615Affects 0.1.5 to 0.6.0 (through the newest release)
- CVE-2026-83614Affects 0.3.0 to 0.6.0 (through the newest release)
- CVE-2026-83613Affects 0.1.0 to 0.6.0 (through the newest release)
- CVE-2026-83611Affects 0.1.0 to 0.6.0 (through the newest release)
- CVE-2026-83610Affects 0.1.0 to 0.6.0 (through the newest release)
- CVE-2026-83608Affects 0.1.0 to 0.6.0 (through the newest release)
- CVE-2026-83607Affects 0.1.0 to 0.6.0 (through the newest release)
- CVE-2026-83605Affects 0.1.0 to 0.6.0 (through the newest release)
- CVE-2026-41675Affects 0.1.0 to 0.6.0 (through the newest release)
- CVE-2026-41674Affects 0.1.0 to 0.6.0 (through the newest release)
- CVE-2026-41673Affects 0.1.0 to 0.6.0 (through the newest release)
Show all 17 advisoriesShow fewer advisories
- CVE-2026-41672Affects 0.1.0 to 0.6.0 (through the newest release)
- CVE-2026-34601Affects 0.1.0 to 0.6.0 (through the newest release)
- CVE-2022-39353Affects 0.1.0 to 0.6.0 (through the newest release)
- CVE-2021-32796Affects 0.1.0 to 0.6.0 (through the newest release)
- CVE-2021-21366Affects 0.1.0 to 0.4.0 (0.5.0 is outside it)
Advisories 17
- CVE-2026-83616High 8.7
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
Affected: through 0.6.0.
No fix released. The latest release, 0.6.0, is still affected.
100% of xmldom downloads last week were affected versions (2.2M).
- CVE-2026-83615High 8.7
xmldom: Quadratic-memory consumption
Affected: from 0.1.5, through 0.6.0.
No fix released. The latest release, 0.6.0, is still affected.
>99.9% of xmldom downloads last week were affected versions (2.2M).
- CVE-2026-83614High 8.7
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
Affected: from 0.3.0, through 0.6.0.
No fix released. The latest release, 0.6.0, is still affected.
43% of xmldom downloads last week were affected versions (946K).
- CVE-2026-83613High 8.7
xmldom: Quadratic-time attribute deduplication
Affected: through 0.6.0.
No fix released. The latest release, 0.6.0, is still affected.
100% of xmldom downloads last week were affected versions (2.2M).
- CVE-2026-83611Medium 6.9
xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content
Affected: through 0.6.0.
No fix released. The latest release, 0.6.0, is still affected.
100% of xmldom downloads last week were affected versions (2.2M).
- CVE-2026-83610Medium 6.3
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
Affected: through 0.6.0.
No fix released. The latest release, 0.6.0, is still affected.
100% of xmldom downloads last week were affected versions (2.2M).
- CVE-2026-83608High 8.7
xmldom: DocType `name` Injection Bypasses requireWellFormed
Affected: through 0.6.0.
No fix released. The latest release, 0.6.0, is still affected.
100% of xmldom downloads last week were affected versions (2.2M).
- CVE-2026-83607High 8.7
xmldom: Element name injection via createElement() bypasses requireWellFormed
Affected: through 0.6.0.
No fix released. The latest release, 0.6.0, is still affected.
100% of xmldom downloads last week were affected versions (2.2M).
- CVE-2026-83605High 8.7
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
Affected: through 0.6.0.
No fix released. The latest release, 0.6.0, is still affected.
100% of xmldom downloads last week were affected versions (2.2M).
- CVE-2026-41675High 8.7
xmldom: XML node injection through unvalidated processing instruction serialization
Affected: through 0.6.0.
No fix released. The latest release, 0.6.0, is still affected.
100% of xmldom downloads last week were affected versions (2.2M).
- CVE-2026-41674High 8.7
xmldom: XML injection through unvalidated DocumentType serialization
Affected: through 0.6.0.
No fix released. The latest release, 0.6.0, is still affected.
100% of xmldom downloads last week were affected versions (2.2M).
- CVE-2026-41673High 8.7
xmldom: Denial of service via uncontrolled recursion in XML serialization
Affected: through 0.6.0.
No fix released. The latest release, 0.6.0, is still affected.
100% of xmldom downloads last week were affected versions (2.2M).
- CVE-2026-41672High 8.7
xmldom: XML node injection through unvalidated comment serialization
Affected: through 0.6.0.
No fix released. The latest release, 0.6.0, is still affected.
100% of xmldom downloads last week were affected versions (2.2M).
- CVE-2026-34601High 7.5
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
Affected: through 0.6.0.
No fix released. The latest release, 0.6.0, is still affected.
100% of xmldom downloads last week were affected versions (2.2M).
- CVE-2022-39353Critical 9.4
xmldom allows multiple root nodes in a DOM
Affected: through 0.6.0.
No fix released. The latest release, 0.6.0, is still affected.
100% of xmldom downloads last week were affected versions (2.2M).
Show all 17 advisoriesShow fewer advisories
- CVE-2021-32796Medium 6.5
Misinterpretation of malicious XML input in xmldom
Affected: through 0.6.0.
No fix released. The latest release, 0.6.0, is still affected.
100% of xmldom downloads last week were affected versions (2.2M).
- CVE-2021-21366Medium 4.3
Misinterpretation of malicious XML input
Affected: fixed in 0.5.0.
Fixed in 0.5.0 (released Mar 9, 2021, 3 days before disclosure).
The latest release, 0.6.0, is not affected.
62% of xmldom downloads last week were affected versions (1.4M).