Description
The @xmldom/xmldom serializer emits DocumentType.name verbatim into the <!DOCTYPE …> declaration with no well-formedness guard. GHSA-f6ww-3ggp-fr8h (CVE-2026-41674) hardened the serializer’s requireWellFormed path for a DocumentType’s sibling fields — publicId, systemId, and internalSubset — but it did not add any check for name.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 0.6.0
References
Could your website be exposed too?
SmartScanner can check your website for xmldom: DocType `name` Injection Bypasses requireWellFormed - xmldom and gives you actionable findings to investigate.
Start a free scanRelated Issues
- xmldom: DocType `name` Injection Bypasses requireWellFormed - CVE-2026-83608
- xmldom: Element name injection via createElement() bypasses requireWellFormed - CVE-2026-83607
- xmldom: Element name injection via createElement() bypasses requireWellFormed - xmldom - CVE-2026-83607
- xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed - CVE-2026-83605
You might also like:
See something that needs correcting? Let us knowUpdated September 08, 2026