# xmldom (npm) vulnerabilities 17 known vulnerabilities (1 critical, 12 high, 4 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.6.0 (Apr 17, 2021): affected by 16 advisories - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 1.8M - Dependents: 2,016 - Releases: 36 since 0.1.0 (Jan 6, 2012) - Registry: https://www.npmjs.com/package/xmldom - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-83616: 0.1.0 to 0.6.0 (through the newest release) - CVE-2026-83615: 0.1.5 to 0.6.0 (through the newest release) - CVE-2026-83614: 0.3.0 to 0.6.0 (through the newest release) - CVE-2026-83613: 0.1.0 to 0.6.0 (through the newest release) - CVE-2026-83611: 0.1.0 to 0.6.0 (through the newest release) - CVE-2026-83610: 0.1.0 to 0.6.0 (through the newest release) - CVE-2026-83608: 0.1.0 to 0.6.0 (through the newest release) - CVE-2026-83607: 0.1.0 to 0.6.0 (through the newest release) - CVE-2026-83605: 0.1.0 to 0.6.0 (through the newest release) - CVE-2026-41675: 0.1.0 to 0.6.0 (through the newest release) - CVE-2026-41674: 0.1.0 to 0.6.0 (through the newest release) - CVE-2026-41673: 0.1.0 to 0.6.0 (through the newest release) - CVE-2026-41672: 0.1.0 to 0.6.0 (through the newest release) - CVE-2026-34601: 0.1.0 to 0.6.0 (through the newest release) - CVE-2022-39353: 0.1.0 to 0.6.0 (through the newest release) - CVE-2021-32796: 0.1.0 to 0.6.0 (through the newest release) - CVE-2021-21366: 0.1.0 to 0.4.0 (0.5.0 is outside it) ## Advisories (17) ### [CVE-2026-83616](https://cve.now/CVE-2026-83616): xmldom: Processing Instruction Target Injection Bypasses requireWellFormed - Severity: High 8.7 - Published: Sep 1, 2026 - Affected: through 0.6.0. - No fix released. The latest release, 0.6.0, is still affected. - 100% of xmldom downloads last week were affected versions (2.2M). ### [CVE-2026-83615](https://cve.now/CVE-2026-83615): xmldom: Quadratic-memory consumption - Severity: High 8.7 - Published: Sep 1, 2026 - Affected: from 0.1.5, through 0.6.0. - No fix released. The latest release, 0.6.0, is still affected. - >99.9% of xmldom downloads last week were affected versions (2.2M). ### [CVE-2026-83614](https://cve.now/CVE-2026-83614): xmldom: Quadratic-time parsing via the malformed-input recovery path — \`parseElementStartPart\` re-scan and \`normalize()\` adjacent-text merge - Severity: High 8.7 - Published: Sep 1, 2026 - Affected: from 0.3.0, through 0.6.0. - No fix released. The latest release, 0.6.0, is still affected. - 43% of xmldom downloads last week were affected versions (946K). ### [CVE-2026-83613](https://cve.now/CVE-2026-83613): xmldom: Quadratic-time attribute deduplication - Severity: High 8.7 - Published: Sep 1, 2026 - Affected: through 0.6.0. - No fix released. The latest release, 0.6.0, is still affected. - 100% of xmldom downloads last week were affected versions (2.2M). ### [CVE-2026-83611](https://cve.now/CVE-2026-83611): xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content - Severity: Medium 6.9 - Published: Sep 1, 2026 - Affected: through 0.6.0. - No fix released. The latest release, 0.6.0, is still affected. - 100% of xmldom downloads last week were affected versions (2.2M). ### [CVE-2026-83610](https://cve.now/CVE-2026-83610): xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization - Severity: Medium 6.3 - Published: Sep 1, 2026 - Affected: through 0.6.0. - No fix released. The latest release, 0.6.0, is still affected. - 100% of xmldom downloads last week were affected versions (2.2M). ### [CVE-2026-83608](https://cve.now/CVE-2026-83608): xmldom: DocType \`name\` Injection Bypasses requireWellFormed - Severity: High 8.7 - Published: Sep 1, 2026 - Affected: through 0.6.0. - No fix released. The latest release, 0.6.0, is still affected. - 100% of xmldom downloads last week were affected versions (2.2M). ### [CVE-2026-83607](https://cve.now/CVE-2026-83607): xmldom: Element name injection via createElement() bypasses requireWellFormed - Severity: High 8.7 - Published: Sep 1, 2026 - Affected: through 0.6.0. - No fix released. The latest release, 0.6.0, is still affected. - 100% of xmldom downloads last week were affected versions (2.2M). ### [CVE-2026-83605](https://cve.now/CVE-2026-83605): xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed - Severity: High 8.7 - Published: Sep 1, 2026 - Affected: through 0.6.0. - No fix released. The latest release, 0.6.0, is still affected. - 100% of xmldom downloads last week were affected versions (2.2M). ### [CVE-2026-41675](https://cve.now/CVE-2026-41675): xmldom: XML node injection through unvalidated processing instruction serialization - Severity: High 8.7 - Published: May 7, 2026 - Affected: through 0.6.0. - No fix released. The latest release, 0.6.0, is still affected. - 100% of xmldom downloads last week were affected versions (2.2M). ### [CVE-2026-41674](https://cve.now/CVE-2026-41674): xmldom: XML injection through unvalidated DocumentType serialization - Severity: High 8.7 - Published: May 7, 2026 - Affected: through 0.6.0. - No fix released. The latest release, 0.6.0, is still affected. - 100% of xmldom downloads last week were affected versions (2.2M). ### [CVE-2026-41673](https://cve.now/CVE-2026-41673): xmldom: Denial of service via uncontrolled recursion in XML serialization - Severity: High 8.7 - Published: May 7, 2026 - Affected: through 0.6.0. - No fix released. The latest release, 0.6.0, is still affected. - 100% of xmldom downloads last week were affected versions (2.2M). ### [CVE-2026-41672](https://cve.now/CVE-2026-41672): xmldom: XML node injection through unvalidated comment serialization - Severity: High 8.7 - Published: May 7, 2026 - Affected: through 0.6.0. - No fix released. The latest release, 0.6.0, is still affected. - 100% of xmldom downloads last week were affected versions (2.2M). ### [CVE-2026-34601](https://cve.now/CVE-2026-34601): xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion - Severity: High 7.5 - Published: Apr 2, 2026 - Affected: through 0.6.0. - No fix released. The latest release, 0.6.0, is still affected. - 100% of xmldom downloads last week were affected versions (2.2M). ### [CVE-2022-39353](https://cve.now/CVE-2022-39353): xmldom allows multiple root nodes in a DOM - Severity: Critical 9.4 - Published: Nov 2, 2022 - Affected: through 0.6.0. - No fix released. The latest release, 0.6.0, is still affected. - 100% of xmldom downloads last week were affected versions (2.2M). ### [CVE-2021-32796](https://cve.now/CVE-2021-32796): Misinterpretation of malicious XML input in xmldom - Severity: Medium 6.5 - Published: Jul 27, 2021 - Affected: through 0.6.0. - No fix released. The latest release, 0.6.0, is still affected. - 100% of xmldom downloads last week were affected versions (2.2M). ### [CVE-2021-21366](https://cve.now/CVE-2021-21366): Misinterpretation of malicious XML input - Severity: Medium 4.3 - Published: Mar 12, 2021 - Affected: fixed in 0.5.0. - Fixed in 0.5.0 (released Mar 9, 2021, 3 days before disclosure). - The latest release, 0.6.0, is not affected. - 62% of xmldom downloads last week were affected versions (1.4M). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/xmldom Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.