CVE-2026-83611

A flaw was found in xmldom, a JavaScript XML DOM parser. The DOMParser.parseFromString() function can silently accept malformed XML end tags that include a line break and additional content. This unexpected parsing behavior causes the parser to close the element prematurely and discard the trailing content. This could potentially bypass security checks that rely on strict XML well-formedness, leading to data loss or misinterpretation in applications processing untrusted XML input.

A flaw was found in the xmldom JavaScript package. The DOMParser.parseFromString() function mishandles malformed XML end tags containing line breaks and trailing content due to incomplete regex boundary validation during parsing. An attacker supplying crafted XML input can cause the parser to prematurely close XML elements and silently discard trailing data, bypassing parse-before-trust well-formedness gates. While this does not result in arbitrary node injection, it causes data integrity issues and potential security logic bypasses in downstream applications relying on strict XML verification.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Validate XML inputs against a strict schema or pre-parse XML documents using an alternative conforming parser prior to processing untrusted input with xmldom.