CVE-2026-83606

A flaw was found in xmldom, a JavaScript XML DOM parser. This vulnerability, a Regular Expression Denial of Service (ReDoS), occurs due to inefficient processing of unterminated processing instructions in XML input. A remote, unauthenticated attacker can send a specially crafted XML input, causing quadratic backtracking and stalling the Node.js event loop. This can lead to a Denial of Service (DoS) for applications using xmldom.

Important: A Regular Expression Denial of Service (ReDoS) flaw in the xmldom library allows a remote, unauthenticated attacker to cause a denial of service. By sending specially crafted XML input, an attacker can trigger quadratic backtracking, leading to the Node.js event loop stalling in applications utilizing xmldom, such as OpenShift Container Platform and JupyterLab.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.