Description
xmldom’s malformed-input error-recovery path has two quadratic-time (O(n²)) behaviors that a single crafted input triggers together, so a tiny, highly compressible document (tens of KB) stalls the Node.js event loop for multiple seconds. It is reachable from DOMParser.parseFromString under default options — i.e.
Recommendation
No fix is available yet. Followings are affected versions:
- >= 0.3.0, <= 0.6.0
References
Could your website be exposed too?
SmartScanner can check your website for xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` - xmldom and gives you actionable findings to investigate.
Start a free scanRelated Issues
- xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` - CVE-2026-83614
- markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled - CVE-2026-111766
- xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the - CVE-2026-83609
- xmldom: Quadratic-time attribute deduplication - CVE-2026-83613
You might also like:
See something that needs correcting? Let us knowUpdated September 08, 2026