CVE-2026-83619

A flaw was found in xmldom, a JavaScript module used for processing XML documents. A remote attacker could exploit a vulnerability in the XML parser by submitting a specially crafted XML input. This could lead to a Denial of Service (DoS), causing the affected system to become unresponsive by stalling the Node.js event loop. The vulnerability stems from a regular expression that processes end-tags inefficiently, consuming excessive resources.

This vulnerability has been rated with an Important impact because an unauthenticated remote attacker can exploit it to cause severe resource exhaustion and deny service across applications running on Node.js. In typical deployments where services parse untrusted XML structures using standard settings, handling closing tags with extensive whitespace sequences induces quadratic backtracking. Because this processing blocks the primary event execution thread, services become unresponsive to incoming requests, though the flaw does not compromise data integrity or confidentiality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.