CVE-2026-83606
1 advisory.
npm/@xmldom/xmldom CVE-2026-83606: high, EPSS 0.52%
xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
Action: Upgrade @xmldom/xmldom to 0.9.11 or later.
npm i @xmldom/xmldom@0.9.11Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.9.0-beta.9 | 0.9.11 | - |
Fixed versions
| 0.9.11 |
Sources
- osv: GHSA-g53g-w8rj-fmg7
- https://github.com/xmldom/xmldom/security/advisories/GHSA-g53g-w8rj-fmg7
- https://nvd.nist.gov/vuln/detail/CVE-2026-83606
- https://github.com/xmldom/xmldom/pull/1039
- https://github.com/xmldom/xmldom/commit/73df6b8bdbd86f904b9e8c3ab9c49aa54ef2802e
- https://github.com/xmldom/xmldom
- https://github.com/xmldom/xmldom/releases/tag/0.9.11
CVE-2026-83606 · published · modified · JSON