xmldom up to 0.6.0/0.8.14 Namespace Map Cloning lib/sax.js appendElement heap-based overflow

Summaryinfo

A vulnerability labeled as problematic has been found in xmldom up to 0.6.0/0.8.14. This vulnerability affects the function appendElement of the file lib/sax.js of the component Namespace Map Cloning. Executing a manipulation can lead to heap-based overflow. This vulnerability appears as CVE-2026-83615. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in xmldom up to 0.6.0/0.8.14. It has been declared as problematic. This vulnerability affects the function appendElement of the file lib/sax.js of the component Namespace Map Cloning. The manipulation with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect availability. CVE summarizes:

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.1.5 through 0.6.0, appendElement in lib/sax.js uses _copy to clone the complete currentNSMap for each nested element that declares a new namespace prefix. Keeping every ancestor map live on the parse stack creates quadratic peak namespace-map storage, so a small highly compressible XML document can exhaust the process heap before application validation. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-83615 since 08/31/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available.

Upgrading to version 0.8.15 or 0.9.12 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• xmldom

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6.0
• 0.8.0
• 0.8.1
• 0.8.2
• 0.8.3
• 0.8.4
• 0.8.5
• 0.8.6
• 0.8.7
• 0.8.8
• 0.8.9
• 0.8.10
• 0.8.11
• 0.8.12
• 0.8.13
• 0.8.14

Website

• Product: https://github.com/xmldom/xmldom/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion