TI-2026-57711 Aliases CVE-2026-83612 GHSA-6mj3-qw4j-hgrw

xmldom: HTML raw-text closing-tag case mismatch causes output amplification

HIGH 77CWE-178Published 2026-09-01 · Updated 2026-09-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements. parseHtmlSpecialContent, selected by isHTMLRawTextElement or isHTMLEscapableRawTextElement, uses a case-sensitive indexOf() and then calls substring() with a missing-close result of negative one, causing unstable parser progression and quadratic output amplification. A small untrusted text/html document can consequently consume disproportionate CPU and memory when parsed and serialized. This issue is fixed in @xmldom/xmldom version 0.9.12.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00524 44th percentileScored 2026-11-07

Fix Partial xmldom (xmldom): 0.9.12xmldom (@xmldom): 0.9.12+1 more productRed Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
xmldom	xmldom	0.9.0-beta.1 to before 0.9.12	0.9.12	Patch available	CNA
xmldom	xmldom	0.9.0-beta.1 to before 0.9.12	0.9.12	Patch available	CNA
—	@xmldom/xmldom (npm)	0.9.0-beta.1 to before 0.9.12	0.9.12	Patch available	GHSA-6mj3-qw4j-hgrw

xmldom Vendorxmldom Affected 0.9.0-beta.1 to before 0.9.12 Fixed in 0.9.12 Patch available CNA
xmldom Vendorxmldom Affected 0.9.0-beta.1 to before 0.9.12 Fixed in 0.9.12 Patch available CNA
@xmldom/xmldom (npm) Vendor— Affected 0.9.0-beta.1 to before 0.9.12 Fixed in 0.9.12 Patch available GHSA-6mj3-qw4j-hgrw

Remediation

Fix · CNA xmldom (xmldom) Fixed in 0.9.12
Fix · CNA xmldom (@xmldom) Fixed in 0.9.12
Fix · GHSA-6mj3-qw4j-hgrw @xmldom/xmldom (npm) Fixed in 0.9.12 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift Container Platform 4	Affected	No fix yet

Timeline

2026-10-02 Threatist record created from CVE-2026-83612
2026-10-03 Alias added: GHSA-6mj3-qw4j-hgrw

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-83612

Other 5

TI-2022-18728 xmldom allows multiple root nodes in a DOM CVSS 3.1CRITICAL 9.8
TI-2026-57717 xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator CVSS 4.0HIGH 8.7
TI-2026-57716 xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator CVSS 4.0HIGH 8.7
TI-2026-57715 xmldom: Processing Instruction Target Injection Bypasses requireWellFormed CVSS 4.0HIGH 8.7
TI-2026-57714 xmldom: Quadratic-memory consumption CVSS 4.0HIGH 8.7
TI-2026-57712 xmldom: Quadratic-time attribute deduplication CVSS 4.0HIGH 8.7

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences