CVE-2026-83619 xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser
An attacker can cause a denial of service by submitting crafted XML input that triggers quadratic backtracking in the xmldom parser, stalling the application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-83619?
CVE-2026-83619 is a high-severity denial of service vulnerability in @xmldom xmldom, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression /[ \t\n\r]+$/g. For an end tag containing a long whitespace run followed by a non-whitespace character, the expression retries from each possible starting position and backtracks quadratically before failing its end anchor. DOMParser.parseFromString() reaches the path under default options, allowing a small unauthenticated XML input to stall the Node.js event loop; the 0.9.x and unscoped npm lines do not contain this expression. This issue is fixed in @xmldom/xmldom version 0.8.15.
Which versions are affected by CVE-2026-83619?
2 open source packages ship an affected version, including @xmldom/xmldom.
| Package | Affected | Fixed in |
|---|---|---|
@xmldom/xmldom npm | From 0.7.0 | 0.8.15 |
@xmldom/xmldom npm | From 0.7.0 | 0.8.15 |
How do I fix CVE-2026-83619?
Upgrade @xmldom/xmldom to 0.8.15 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-83619 being exploited?
There is no known exploitation of CVE-2026-83619 in the wild and no public exploit code.
Sources
Also known as AZL-99336, CLEANSTART-2026-NW59337, DEBIAN-CVE-2026-83619, ECHO-a029-6e2a-1037, GHSA-x4fp-j954-r2f4, MINI-36jg-fcj9-6pwc and 5 more.