CVE-2026-83611 in xmldom
Summary
by MITRE • 09/01/2026
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString() can silently accept an end tag such as </a\njunk>, close the element, and discard the trailing content. On 0.9.x, the lib/sax.js end-tag validator inherits the multiline flag from reg(), allowing the first line to satisfy the anchored XML ETag production; older lines have no equivalent residue validation. This parser differential can bypass a parse-before-trust well-formedness gate, although it does not inject the discarded content; onError on 0.9.x and errorHandler on 0.8.x are the relevant reporting interfaces. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified within the xmldom library, specifically affecting versions prior to 0.8.15 and 0.9.12 as well as older releases like 0.6.0, represents a critical flaw in XML parsing logic that undermines the integrity of document structure validation. This JavaScript module implements W3C standard-based DOMParser functionality, yet it contains a specific defect where the parseFromString method fails to properly enforce end-tag boundaries under certain conditions. When processing an input string containing an end tag such as </element>, the parser silently accepts this closure and subsequently discards any trailing content that follows within the same logical block or line context. This behavior deviates from strict XML well-formedness requirements, which mandate that all open tags must be properly closed without residual unparsed data remaining in a way that alters the document tree structure unexpectedly.
The technical root cause of this issue lies in the implementation details of the SAX parser component within the library. In version 0.9.x, the end-tag validation logic in lib/sax.js inherits the multiline flag from an internal regular expression function named reg(). This inheritance allows the first line of a multi-line input to satisfy the anchored XML End-Tag production rules effectively. However, subsequent lines do not receive equivalent residue validation checks. Consequently, if trailing content exists after a validly closed tag on those later lines, it is ignored rather than triggering an error or being included in the parsed document tree. This differential behavior creates a parsing inconsistency where some parts of the XML are validated strictly while others are silently truncated, leading to unpredictable outcomes depending on how the input data is structured and line-broken.
From a security perspective, this vulnerability poses significant risks related to logic bypasses and injection attacks. Although the discarded content is not injected into the resulting DOM tree, which mitigates direct code execution or cross-site scripting via payload insertion in some contexts, it can still be exploited for more subtle attack vectors. An attacker could craft malicious XML inputs that rely on this silent truncation to bypass parse-before-trust well-formedness gates implemented by upstream applications. These gates are designed to ensure data integrity before processing; if the parser silently discards parts of a potentially dangerous payload or alters the structure in unexpected ways, downstream security controls may fail to detect threats embedded in the truncated sections. This aligns with CWE-20 Improper Input Validation and CWE-749 Exposed Dangerous Method or Function, as the library exposes parsing behavior that does not strictly adhere to its stated standards.
The operational impact of this flaw is primarily centered on data integrity and reliability rather than direct system compromise through code execution. Applications relying on xmldom for configuration file processing, SOAP message handling, or any XML-based protocol interaction may experience silent data loss or structural corruption if inputs contain trailing content after end tags in multi-line contexts. This can lead to logical errors where critical parameters are omitted from the processed object model without raising an exception, potentially causing downstream failures or incorrect business logic execution. The severity is heightened by the fact that older versions like 0.6.0 lack any fixed release, forcing maintainers of legacy systems to either patch their own forks or migrate away from this library entirely.
Mitigation strategies require immediate action for affected environments. For users on version 0.9.x and 0.8.x, upgrading to xmldom/xmldom versions 0.9.12 and 0.8.15 respectively is the primary remediation step, as these releases address the multiline flag inheritance issue and enforce consistent residue validation across all lines of input. For users stuck on xmldom version 0.6.0 or earlier where no official fix exists, it is strongly recommended to migrate to a maintained alternative such as xmldom/xmldom in its newer versions or other robust XML parsing libraries that strictly adhere to W3C standards and provide comprehensive error reporting via onError or errorHandler interfaces. Additionally, implementing strict input validation at the application layer before passing data to the parser can serve as an additional defense-in-depth measure, ensuring that only well-formed XML structures are processed regardless of underlying library vulnerabilities.