CVE-2026-83614

xmldom , a pure JavaScript XML DOM parser, is vulnerable to quadratic-time denial of service via two independent code paths. The first, in lib/sax.js, causes parseElementStartPart to repeatedly rescan a malformed tag name to the next > during single-character recovery, reachable through the de...