Inefficient regular expression complexity in xmldom - #VU142547
Published: August 14, 2026
Vulnerability identifier: #VU142547
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient regular expression complexity in the processing-instruction grammar regex in lib/grammar.js when parsing an unterminated processing instruction. A remote attacker can send a specially crafted XML document to cause a denial of service.
The issue is reachable through DOMParser.parseFromString under default options and can stall the Node.js event loop during parsing.
Affected software
xmldom
Remediation
Install security update from vendor's website.
xmldom - update to 0.9.11