Description
xmldom builds the attribute collection of every parsed element by inserting attributes one at a time into a DOM NamedNodeMap. Each insertion first performs a linear scan of all already-inserted attributes to enforce the DOM uniqueness rule (no two attributes with the same qualified name / namespace+local-name).
Recommendation
No fix is available yet. Followings are affected versions:
- <= 0.6.0
References
Could your website be exposed too?
SmartScanner can check your website for xmldom: Quadratic-time attribute deduplication - xmldom and gives you actionable findings to investigate.
Start a free scanRelated Issues
- xmldom: Quadratic-time attribute deduplication - CVE-2026-83613
- xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` - CVE-2026-83614
- xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` - xmldom - CVE-2026-83614
- xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser - CVE-2026-83619
You might also like:
See something that needs correcting? Let us knowUpdated September 08, 2026