xmldom allows multiple root nodes in a DOM

Description

xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the childNodes collection of the Document, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to https://nvd.nist.

Recommendation

Update the @xmldom/xmldom package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 0.9.0-beta.1, < 0.9.0-beta.4

  >= 0.8.0, < 0.8.4

  < 0.7.7**

• Patched version(s): **0.9.0-beta.4

  0.8.4

  0.7.7**

References

• GHSA-crh6-fp67-6883
• lists.debian.org
• CVE-2022-39353
• CWE-1288
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• xmldom allows multiple root nodes in a DOM - xmldom - CVE-2022-39353
• xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion - CVE-2026-34601
• nadesiko3 allows remote attacker to inject invalid value to decodeURIComponent of nako3edit - CVE-2022-41777
• xmldom has XML node injection through unvalidated comment serialization - CVE-2026-41672

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@xmldom/xmldom