xmldom: Uncontrolled recursion in XML serialization leads to DoS - xmldom

Description

Seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application.

Reported operations:

• Node.prototype.normalize() — reported by @praveen-kv (email 2026-04-05) and @KarimTantawey (GHSA-fwmp-8wwc-qhv6, via DOMParser.parseFromString())
• `XMLSerializer.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.6.0

References

• GHSA-2v35-w6hq-6mfw
• CVE-2026-41673
• CWE-674
• CAPEC-310
• OWASP 2021-A6

Related Issues

• xmldom: Uncontrolled recursion in XML serialization leads to DoS - CVE-2026-41673
• xmldom has XML injection through unvalidated DocumentType serialization - CVE-2026-41674
• xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion - xmldom - CVE-2026-34601
• xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion - CVE-2026-34601

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

xmldom