Description
Seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application.
Reported operations:
Node.prototype.normalize()— reported by @praveen-kv (email 2026-04-05) and @KarimTantawey (GHSA-fwmp-8wwc-qhv6, viaDOMParser.parseFromString())- `XMLSerializer.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 0.6.0
References
Could your website be exposed too?
SmartScanner can check your website for xmldom: Uncontrolled recursion in XML serialization leads to DoS - xmldom and gives you actionable findings to investigate.
Start a free scanRelated Issues
- xmldom: Uncontrolled recursion in XML serialization leads to DoS - CVE-2026-41673
- xmldom has XML injection through unvalidated DocumentType serialization - CVE-2026-41674
- xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion - xmldom - CVE-2026-34601
- xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion - CVE-2026-34601
You might also like:
See something that needs correcting? Let us knowUpdated May 08, 2026