CVE-2026-83612
highpriority · track · 0EPSS 0.005 · 44 %ileDERUUSEPSS · scored 2026-10-27
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements. parseHtmlSpecialContent, selected by isHTMLRawTextElement or isHTMLEscapableRawTextElement, uses a case-sensitive indexOf() and then calls substring() with a missing-close result of negative one, causing unstable parser progression and quadratic output amplification. A small untrusted text/html document can consequently consume disproportionate CPU and memory when parsed and serialized. This issue is fixed in @xmldom/xmldom version 0.9.12.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.6–8.7
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (7)
Products and version ranges known to be affected.
- IBM WebSphere Service Registry and Repositoryall versionscert_bundDEcpe:/a:ibm:websphere_service_registry_and_repository:-
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-3596IBM App Connect Enterprise: Mehrere SchwachstellenDeutsch2026-09-27csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um einen Cross-Site Scripting Angriff durchzuführen.
- GHSA-6mj3-qw4j-hgrwxmldom: HTML raw-text closing-tag case mismatch causes output amplification2026-09-08ghsa · osvUS
## Summary In HTML mode (`text/html`), a raw-text element (`script`, `style`, `textarea`, `title`) whose closing tag differs in case from its opening tag (e.g. `</ScRiPt>` for `<script>`) is mishandled by the parser, producing quadratic (O(n²)) output growth — a small crafted document parses and serializes into output orders of magnitude larger, exhausting CPU and memory. A modest input of tens of KB can therefore cause a denial of service in any service that parses untrusted HTML with xmldom. Only HTML mode is affected. ## Details The parser calls `parseHtmlSpecialContent` for each raw-text element in HTML mode, matched via `isHTMLRawTextElement` / `isHTMLEscapableRawTextElement` (so all four types — `script`, `style`, `textarea`, `title` — are in scope). It searches for the element's closing tag with `source.indexOf('</' + tagName + '>', elStartEnd)`, a byte-for-byte case-sensitive match. A mixed-case closing tag never matches, so the search returns `-1`, and the following `source.substring(elStartEnd + 1, -1)` extracts text backwards from the start of the document instead of the element's content. The function then returns `-1` to the parse loop, which cannot advance normally and falls back to character-by-character reprocessing. Every raw-text element re-captures all source text preceding it, so output grows as O(n²) in the number of such elements. ### Root Cause 1. **Case-sensitive close-tag search** (`lib/sax.js:549`): `source.indexOf('</' + tagName + '>', elStartEnd)` does not fold case, contrary to the WHATWG HTML RAWTEXT end-tag-name rule. 2. **Unguarded `-1`** (`lib/sax.js:550`): `source.substring(elStartEnd + 1, elEndStart)` runs even when `elEndStart === -1`, extracting text backwards from position 0. 3. **Unstable progression** (`lib/sax.js:556`): the function returns `elEndStart` (`-1`), driving repeated character-by-character fallback in the parse loop. ## Affected Versions Only the `0.9.x` line is affected — the amplification was introduced in `0.9.0-beta.1` when `parseHtmlSpecialContent` was refactored, and remains through `0.9.11`. The `0.8.x` line is **not** affected: its older `parseHtmlSpecialContent` does not amplify, despite sharing the same case-sensitive `indexOf`. ## Proof of Concept ```js const { DOMParser, XMLSerializer } = require('@xmldom/xmldom'); const n = 1000; const payload = '<html><body>' + '<script>x</ScRiPt>'.repeat(n) + '</body></html>'; const doc = new DOMParser().parseFromString(payload, 'text/html'); const out = new XMLSerializer().serializeToString(doc); console.log(payload.length, out.length, (out.length / payload.length).toFixed(1) + 'x'); // 18026 9037063 501.3x — an 18 KB input yields ~9 MB of output ``` Output size grows quadratically with the number of case-mismatched raw-text elements: ``` Repeats | Input len | Output len | Ratio 1 | 44 | 109 | 2.5x 100 | 1826 | 93763 | 51.3x 500 | 9026 | 2268563 | 251.3x 1000 | 18026 | 9037063 | 501.3x 2000 | 36026 | 36074063 | 1001.3x ``` Proof of Concept from @KarimTantawey (tested with `script`); the same amplification occurs for `style`, `textarea`, and `title`. ## Impact Small attacker payloads can force disproportionate CPU and memory usage in services that parse and serialize untrusted HTML via xmldom. The quadratic growth means a modest-sized input (tens of kilobytes) can produce output in the tens or hundreds of megabytes, potentially exhausting memory or causing timeouts. The attack only requires HTML mode (`text/html` MIME type) and mixed-case closing tags for any of the four raw-text element types. No special configuration or error handler setup is needed. ## Severity note The CVSS 4.0 vector scores availability only (`VA:H`, with `VC:N/VI:N`): the flaw neither discloses nor corrupts data, but a small untrusted HTML input (tens of KB) can force output and memory in the tens to hundreds of MB, enough to exhaust a service's heap or stall its event loop. It is reachable with no authentication, configuration, or error-handler setup — only that the application parses untrusted `text/html` and serializes the result. ## Fix Applied The raw-text closing tag is now matched case-insensitively in HTML raw-text mode (per the WHATWG HTML [RAWTEXT end-tag rule](https://html.spec.whatwg.org/multipage/parsing.html#rawtext-end-tag-name-state)), and a missing closing tag is handled explicitly, removing the quadratic output amplification. Output for well-formed input is unchanged. Non-breaking; 0.9.x-only.
also known as (1)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4) nvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan