TI-2026-57718 Aliases CVE-2026-83619 GHSA-x4fp-j954-r2f4

xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

MEDIUM 44CWE-1333Published 2026-09-01 · Updated 2026-09-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression /[ \t\n\r]+$/g. For an end tag containing a long whitespace run followed by a non-whitespace character, the expression retries from each possible starting position and backtracks quadratically before failing its end anchor. DOMParser.parseFromString() reaches the path under default options, allowing a small unauthenticated XML input to stall the Node.js event loop; the 0.9.x and unscoped npm lines do not contain this expression. This issue is fixed in @xmldom/xmldom version 0.8.15.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00524 44th percentileScored 2026-11-07

Fix Partial xmldom (xmldom): 0.8.15xmldom (@xmldom): 0.8.15+1 more productRed Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
xmldom	xmldom	0.7.0 to before 0.8.15	0.8.15	Patch available	CNA
xmldom	xmldom	0.7.0 to before 0.8.15	0.8.15	Patch available	CNA
—	@xmldom/xmldom (npm)	0.7.0 to before 0.8.15	0.8.15	Patch available	GHSA-x4fp-j954-r2f4

xmldom Vendorxmldom Affected 0.7.0 to before 0.8.15 Fixed in 0.8.15 Patch available CNA
xmldom Vendorxmldom Affected 0.7.0 to before 0.8.15 Fixed in 0.8.15 Patch available CNA
@xmldom/xmldom (npm) Vendor— Affected 0.7.0 to before 0.8.15 Fixed in 0.8.15 Patch available GHSA-x4fp-j954-r2f4

Remediation

Fix · CNA xmldom (xmldom) Fixed in 0.8.15
Fix · CNA xmldom (@xmldom) Fixed in 0.8.15
Fix · GHSA-x4fp-j954-r2f4 @xmldom/xmldom (npm) Fixed in 0.8.15 Advisory →

Red Hat 1 advisory

RHSA-2026:69248 Released 2026-09-21 · Red Hat rating Important
Red Hat Developer Hub 1.9.9 release.
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Build of Podman Desktop	Affected	No fix yet
Red Hat Enterprise Linux 8	Affected	No fix yet
Red Hat Fuse 7	Affected	No fix planned: Will not fix
Red Hat Developer Hub 1.9	Fixed	RHSA-2026:69248

Not affected: 4 products

Red Hat Developer Hub 1.9
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 9
Red Hat OpenShift AI (RHOAI)

Timeline

2026-10-02 Threatist record created from CVE-2026-83619
2026-10-03 Alias added: GHSA-x4fp-j954-r2f4
2026-10-13 Affected versions changed · Red Hat

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-83619

Other 5

TI-2022-18728 xmldom allows multiple root nodes in a DOM CVSS 3.1CRITICAL 9.8
TI-2026-57717 xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator CVSS 4.0HIGH 8.7
TI-2026-57716 xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator CVSS 4.0HIGH 8.7
TI-2026-57715 xmldom: Processing Instruction Target Injection Bypasses requireWellFormed CVSS 4.0HIGH 8.7
TI-2026-57714 xmldom: Quadratic-memory consumption CVSS 4.0HIGH 8.7
TI-2026-57712 xmldom: Quadratic-time attribute deduplication CVSS 4.0HIGH 8.7

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences