EUVD-2026-69227

xmldom: HTML raw-text closing-tag case mismatch causes output amplification...

6thbridge-hexa-docs (0.0.1), @12-labours/mapintegratedvuer (>=1.0.0-beta.0, <=1.0.0-beta.14) +1093 more potentially affected by CVE-2026-83612 via @xmldom/xmldom (>=0.9.0-beta.8, <=0.9.11)

@xmldom/xmldom NPM version =0.9.0-beta.8, =1.0.0-beta.0, =0.0.1, =0.0.1, =0.0.1, =2.4.4, =0.1.30-develop-map-0, =0.1.0, =0.3.2-beta.0, =2.0.2, =0.8.1, =0.1.0, =0.8.0, =0.1.0, =0.2.2 and more Source cves: CVE-2026-83612 Source advisory: GHSA-6MJ3-QW4J-HGRW...

GHSA-6MJ3-QW4J-HGRW xmldom: HTML raw-text closing-tag case mismatch causes output amplification

Summary In HTML mode text/html, a raw-text element script, style, textarea, title whose closing tag differs in case from its opening tag e.g. for is mishandled by the parser, producing quadratic On² output growth — a small crafted document parses and serializes into output orders of magnitude...

EUVD-2026-69216

xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions...

xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

Summary @xmldom/xmldom's processing-instruction PI grammar regex exhibits quadratic-time backtracking ReDoS when parsing an unterminated processing instruction. A single small XML document containing forces the regular expression engine into On² work, stalling the Node.js event loop. The input is...

GHSA-G53G-W8RJ-FMG7 xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

Summary @xmldom/xmldom's processing-instruction PI grammar regex exhibits quadratic-time backtracking ReDoS when parsing an unterminated processing instruction. A single small XML document containing forces the regular expression engine into On² work, stalling the Node.js event loop. The input is...

EUVD-2026-69217

xmldom: Element name injection via createElement bypasses requireWellFormed...

GHSA-W2RR-34G9-RVRJ xmldom: Element name injection via createElement() bypasses requireWellFormed

Summary Document.createElement in @xmldom/xmldom accepts arbitrary strings as the tagName parameter with zero validation. The serializer emits the tag name verbatim into XML/HTML output. Critically, the requireWellFormed: true serializer option — the recommended mitigation from CVE-2026-41672,...

xmldom: Element name injection via createElement() bypasses requireWellFormed

Summary Document.createElement in @xmldom/xmldom accepts arbitrary strings as the tagName parameter with zero validation. The serializer emits the tag name verbatim into XML/HTML output. Critically, the requireWellFormed: true serializer option — the recommended mitigation from CVE-2026-41672,...

NPM: xmldom: Element name injection via createElement() bypasses requireWellFormed

NPM: xmldom: Element name injection via createElement bypasses requireWellFormed vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...

6thbridge-hexa-docs (0.0.1), @12-labours/mapintegratedvuer (>=1.0.0-beta.0, <=1.0.0-beta.14) +1089 more potentially affected by CVE-2026-83607 via @xmldom/xmldom (>=0.9.0, <=0.9.10)

@xmldom/xmldom NPM version =0.9.0, =1.0.0-beta.0, =0.0.1, =0.0.1, =0.0.1, =2.4.4, =0.1.30-develop-map-0, =0.1.0, =0.3.2-beta.0, =2.0.2, =0.8.1, =0.1.0, =0.8.0, =0.1.0, =0.2.2 and more Source cves: CVE-2026-83607 Source advisory: OSV:GHSA-W2RR-34G9-RVRJ...

08cms (1.0.0), 0uth (>=1.0.5, <=1.2.1) +12683 more potentially affected by CVE-2026-83607 via xmldom (>=0.1.2, <=0.6.0)

xmldom NPM version =0.1.2, =1.0.5, =1.0.0, =1.0.0, =1.7.3, =0.1.0, =0.0.2, =0.0.1, =1.0.2, =1.0.3, =1.0.23, =1.0.1, =1.3.1 and more Source cves: CVE-2026-83607 Source advisory: OSV:GHSA-W2RR-34G9-RVRJ...

08cms (1.0.0), 0uth (>=1.0.5, <=1.2.1) +12683 more potentially affected by CVE-2026-83607 via xmldom (>=0.1.2, <=0.6.0)

xmldom NPM version =0.1.2, =1.0.5, =1.0.0, =1.0.0, =1.7.3, =0.1.0, =0.0.2, =0.0.1, =1.0.2, =1.0.3, =1.0.23, =1.0.1, =1.3.1 and more Source cves: CVE-2026-83607 Source advisory: GHSA-W2RR-34G9-RVRJ...

2c2p-integration (>=0.2.0, <=0.2.2), 4help-shared (>=1.0.8, <=1.0.15) +4405 more potentially affected by CVE-2026-83607 via @xmldom/xmldom (>=0.7.0, <=0.8.13)

@xmldom/xmldom NPM version =0.7.0, =0.2.0, =1.0.8, =0.1.3, =0.0.7, =0.3.31, =1.0.4, =1.0.0, =2.1.0-develop-2ff6c7-mckmjkzz, =0.12.0, =0.0.1, =0.0.2 and more Source cves: CVE-2026-83607 Source advisory: OSV:GHSA-W2RR-34G9-RVRJ...

2c2p-integration (>=0.2.0, <=0.2.2), 4help-shared (>=1.0.8, <=1.0.15) +4405 more potentially affected by CVE-2026-83607 via @xmldom/xmldom (>=0.7.0, <=0.8.13)

@xmldom/xmldom NPM version =0.7.0, =0.2.0, =1.0.8, =0.1.3, =0.0.7, =0.3.31, =1.0.4, =1.0.0, =2.1.0-develop-2ff6c7-mckmjkzz, =0.12.0, =0.0.1, =0.0.2 and more Source cves: CVE-2026-83607 Source advisory: GHSA-W2RR-34G9-RVRJ...

6thbridge-hexa-docs (0.0.1), @12-labours/mapintegratedvuer (>=1.0.0-beta.0, <=1.0.0-beta.14) +1089 more potentially affected by CVE-2026-83607 via @xmldom/xmldom (>=0.9.0, <=0.9.10)

@xmldom/xmldom NPM version =0.9.0, =1.0.0-beta.0, =0.0.1, =0.0.1, =0.0.1, =2.4.4, =0.1.30-develop-map-0, =0.1.0, =0.3.2-beta.0, =2.0.2, =0.8.1, =0.1.0, =0.8.0, =0.1.0, =0.2.2 and more Source cves: CVE-2026-83607 Source advisory: GHSA-W2RR-34G9-RVRJ...

GHSA-4W3W-2RP5-G8JM xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

Summary Element.setAttribute in @xmldom/xmldom bypasses attribute name validation by calling the private createAttributename method, which performs no validation. The public createAttribute method correctly validates names against an anchored QName pattern, but setAttribute never uses it. The...

NPM: xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

NPM: xmldom: Attribute name injection via setAttribute bypasses requireWellFormed vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...

2c2p-integration (>=0.2.0, <=0.2.2), 4help-shared (>=1.0.8, <=1.0.15) +4405 more potentially affected by CVE-2026-83605 via @xmldom/xmldom (>=0.7.0, <=0.8.13)

@xmldom/xmldom NPM version =0.7.0, =0.2.0, =1.0.8, =0.1.3, =0.0.7, =0.3.31, =1.0.4, =1.0.0, =2.1.0-develop-2ff6c7-mckmjkzz, =0.12.0, =0.0.1, =0.0.2 and more Source cves: CVE-2026-83605 Source advisory: GHSA-4W3W-2RP5-G8JM...

2c2p-integration (>=0.2.0, <=0.2.2), 4help-shared (>=1.0.8, <=1.0.15) +4405 more potentially affected by CVE-2026-83605 via @xmldom/xmldom (>=0.7.0, <=0.8.13)

@xmldom/xmldom NPM version =0.7.0, =0.2.0, =1.0.8, =0.1.3, =0.0.7, =0.3.31, =1.0.4, =1.0.0, =2.1.0-develop-2ff6c7-mckmjkzz, =0.12.0, =0.0.1, =0.0.2 and more Source cves: CVE-2026-83605 Source advisory: OSV:GHSA-4W3W-2RP5-G8JM...