xmldom: Uncontrolled recursion in XML serialization leads to DoS

Description

Seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application.

Reported operations:

• Node.prototype.normalize() — reported by @praveen-kv (email 2026-04-05) and @KarimTantawey (GHSA-fwmp-8wwc-qhv6, via DOMParser.parseFromString())
• `XMLSerializer.

Recommendation

Update the @xmldom/xmldom package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 0.9.0, < 0.9.10

  < 0.8.13**

• Patched version(s): **0.9.10

  0.8.13**

References

• GHSA-2v35-w6hq-6mfw
• CVE-2026-41673
• CWE-674
• CAPEC-310
• OWASP 2021-A6

Related Issues

• xmldom: Uncontrolled recursion in XML serialization leads to DoS - xmldom - CVE-2026-41673
• xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion - CVE-2026-34601
• xmldom has XML node injection through unvalidated processing instruction serialization - CVE-2026-41675
• xmldom has XML injection through unvalidated DocumentType serialization - CVE-2026-41674

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@xmldom/xmldom