Advisory Database
  • Advisories
  • Dependency Scanning
  1. npm
  2. ›
  3. @xmldom/xmldom
  4. ›
  5. CVE-2026-83612

CVE-2026-83612: xmldom: HTML raw-text closing-tag case mismatch causes output amplification

September 8, 2026

In HTML mode (text/html), a raw-text element (script, style, textarea, title) whose closing tag differs in case from its opening tag (e.g. </ScRiPt> for <script>) is mishandled by the parser, producing quadratic (O(n²)) output growth — a small crafted document parses and serializes into output orders of magnitude larger, exhausting CPU and memory. A modest input of tens of KB can therefore cause a denial of service in any service that parses untrusted HTML with xmldom. Only HTML mode is affected.

References

  • github.com/advisories/GHSA-6mj3-qw4j-hgrw
  • github.com/xmldom/xmldom/commit/7ced40c06c28d151e996a97045018c3559ae4707
  • github.com/xmldom/xmldom/pull/1071
  • github.com/xmldom/xmldom/releases/tag/0.9.12
  • github.com/xmldom/xmldom/security/advisories/GHSA-6mj3-qw4j-hgrw
  • nvd.nist.gov/vuln/detail/CVE-2026-83612

Code Behaviors & Features

Detect and mitigate CVE-2026-83612 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 0.9.0-beta.1 before 0.9.12

Fixed versions

  • 0.9.12

Solution

Upgrade to version 0.9.12 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-178: Improper Handling of Case Sensitivity
  • CWE-400: Uncontrolled Resource Consumption

Source file

npm/@xmldom/xmldom/CVE-2026-83612.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Tue, 22 Sep 2026 12:20:15 +0000.