{"uuid": "c5b8d18b-c936-49cb-89f8-4f3f586ad512", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-6mj3-qw4j-hgrw", "type": "seen", "source": "https://gist.github.com/alon710/6001224d6aa2414b1f8b69a0a75f3dac", "content": "# CVE-2026-83612: CVE-2026-83612: Algorithmic Complexity and Denial of Service via Output Amplification in xmldom\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-83612\n\n## Summary\nA Denial of Service (DoS) vulnerability exists in the xmldom library when parsing HTML-mode documents with mixed-case closing tags for raw-text or escapable raw-text elements like script, style, textarea, or title. This leads to algorithmic complexity issues and quadratic output amplification during DOM serialization.\n\n## TL;DR\nUnauthenticated Denial of Service via quadratic output amplification triggered by parsing HTML with case-mismatched closing raw-text tags in xmldom.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-178 / CWE-400\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS Score**: 8.7\n- **EPSS Score**: 0.00301 (22.45th percentile)\n- **Impact**: Denial of Service (CPU & Memory exhaustion)\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js applications using @xmldom/xmldom for HTML parsing\n- Services processing untrusted XML/HTML documents via standard DOMParser in version range 0.9.0-beta.1 to 0.9.11\n- **@xmldom/xmldom**: >= 0.9.0-beta.1 < 0.9.12 (Fixed in: `0.9.12`)\n\n## Mitigation\n\n- Upgrade @xmldom/xmldom to version 0.9.12 or later.\n- Use package overrides to force dependencies to version 0.9.12.\n- Avoid parsing untrusted HTML documents with legacy versions of the parser.\n\n**Remediation Steps:**\n1. Verify vulnerability with npm ls @xmldom/xmldom.\n2. Execute npm install @xmldom/xmldom@0.9.12 to upgrade.\n3. Add overrides to package.json if it is a transitive dependency.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-6mj3-qw4j-hgrw)\n- [Official GitHub Fixing Commit](https://github.com/xmldom/xmldom/commit/7ced40c06c28d151e996a97045018c3559ae4707)\n- [Official Pull Request](https://github.com/xmldom/xmldom/pull/1071)\n- [Release Release Notes for v0.9.12](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n- [National Vulnerability Database (NVD) Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-83612)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-83612)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-83612) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-08T21:33:08.398244Z"}