---
id: CVE-2026-83612
title: >-
  xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core)
  DOMParser and XMLSerializer module
summary: >-
  xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core)
  DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode
  parsing through DOMParser.parseFromString() mishandles a mixed-case closing
  tag for the s…
severity: high
cwe:
  - CWE-178
  - CWE-400
vendor: xmldom
product: '@xmldom/xmldom'
affected:
  - '@xmldom/xmldom >= 0.9.0-beta.1, <= 0.9.11'
patched:
  - '@xmldom/xmldom 0.9.12'
published: '2026-09-01'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:11:31.703'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-83612'
references:
  - url: >-
      https://github.com/xmldom/xmldom/commit/7ced40c06c28d151e996a97045018c3559ae4707
    label: security-advisories@github.com
  - url: 'https://github.com/xmldom/xmldom/pull/1071'
    label: security-advisories@github.com
  - url: 'https://github.com/xmldom/xmldom/releases/tag/0.9.12'
    label: security-advisories@github.com
  - url: 'https://github.com/xmldom/xmldom/security/advisories/GHSA-6mj3-qw4j-hgrw'
    label: security-advisories@github.com
  - url: 'https://github.com/xmldom/xmldom/security/advisories/GHSA-6mj3-qw4j-hgrw'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-83612'
  - url: 'https://github.com/advisories/GHSA-6mj3-qw4j-hgrw'
tags:
  - nvd
  - ghsa
  - npm
aliases:
  - GHSA-6mj3-qw4j-hgrw
ecosystem: npm
epss: 0.00524
epssPercentile: 0.41992
ingestedAt: '2026-09-08T21:11:12.321Z'
---

## Overview

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements. parseHtmlSpecialContent, selected by isHTMLRawTextElement or isHTMLEscapableRawTextElement, uses a case-sensitive indexOf() and then calls substring() with a missing-close result of negative one, causing unstable parser progression and quadratic output amplification. A small untrusted text/html document can consequently consume disproportionate CPU and memory when parsed and serialized. This issue is fixed in @xmldom/xmldom version 0.9.12.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-83612)

Affected packages:

- `@xmldom/xmldom >= 0.9.0-beta.1, <= 0.9.11`

Patched in:

- `@xmldom/xmldom 0.9.12`

Source: https://github.com/advisories/GHSA-6mj3-qw4j-hgrw