xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator

Description

An embedded line terminator bypasses the requireWellFormed serializer check for a DocumentType’s publicId and systemId.

Recommendation

Update the @xmldom/xmldom package to the latest compatible version. Followings are version details:

Affected version(s): >= 0.9.10, <= 0.9.11
Patched version(s): 0.9.12

References

GHSA-vr34-hp96-76pp
CVE-2026-83618
CWE-625
CWE-91
CAPEC-310

Could your website be exposed too?

SmartScanner can check your website for xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator and gives you actionable findings to investigate.

Start a free scan

Related Issues

xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator - CVE-2026-83617
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the - CVE-2026-83609
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization - CVE-2026-83610
xmldom: DocType `name` Injection Bypasses requireWellFormed - CVE-2026-83608

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated September 08, 2026