{"action":"Upgrade @xmldom/xmldom to 0.8.13 or later.","affected":[{"fixed":"0.8.13","introduced":"0"},{"fixed":"0.9.10","introduced":"0.9.0"}],"component":"@xmldom/xmldom","cve_ids":["CVE-2026-41673"],"ecosystem":"npm","epss":0.00643,"exploited":false,"fixed_versions":["0.8.13","0.9.10"],"ghsa_id":"GHSA-2v35-w6hq-6mfw","id":"tcs_01M5KEV2MGKZ6HWZWCD8YW3BZ9","modified_at":"2026-09-10T03:50:42.381251494Z","published_at":"2026-04-22T20:23:57Z","references":["https://osv.dev/vulnerability/GHSA-2v35-w6hq-6mfw","https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw","https://nvd.nist.gov/vuln/detail/CVE-2026-41673","https://github.com/xmldom/xmldom/commit/17678a2a73ecbd1a2da90f3d47dc23da9cef81aa","https://github.com/xmldom/xmldom/commit/291257493cb0eb6980eda83b162a9c4e6d7d2597","https://github.com/xmldom/xmldom/commit/2d6d6916ed8a4c223db1f6d7560ab4544c465b0f","https://github.com/xmldom/xmldom/commit/430357c7b6333108856e917bf2367afe5ceb6f8a","https://github.com/xmldom/xmldom/commit/4845ef109221df0890825de2822fbe77afba3afe","https://github.com/xmldom/xmldom/commit/8834218c85ac2a4d757b9587c9028e67c2f7b6c3","https://github.com/xmldom/xmldom/commit/8b7cfd1491314abdc347261921d7334ff15f7112","https://github.com/xmldom/xmldom/commit/b0620383abc1df067f3ce1014c43ae1bc1161eeb","https://github.com/xmldom/xmldom/commit/e6edcab6bef5bcdba0b220bb35442aa72f452b84","https://github.com/xmldom/xmldom","https://github.com/xmldom/xmldom/releases/tag/0.8.13","https://github.com/xmldom/xmldom/releases/tag/0.9.10"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-2v35-w6hq-6mfw","url":"https://osv.dev/vulnerability/GHSA-2v35-w6hq-6mfw"},{"source":"nvd","source_id":"CVE-2026-41673","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41673"}],"summary":"xmldom: Uncontrolled recursion in XML serialization leads to DoS"}