{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.6.0"}],"component":"xmldom","cve_ids":["CVE-2026-41673"],"ecosystem":"npm","epss":0.00643,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-2v35-w6hq-6mfw","id":"tcs_01M5KEV2WMQ107R05S7HDCMKY3","modified_at":"2026-09-10T03:50:42.381251494Z","published_at":"2026-04-22T20:23:57Z","references":["https://osv.dev/vulnerability/GHSA-2v35-w6hq-6mfw","https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw","https://nvd.nist.gov/vuln/detail/CVE-2026-41673","https://github.com/xmldom/xmldom/commit/17678a2a73ecbd1a2da90f3d47dc23da9cef81aa","https://github.com/xmldom/xmldom/commit/291257493cb0eb6980eda83b162a9c4e6d7d2597","https://github.com/xmldom/xmldom/commit/2d6d6916ed8a4c223db1f6d7560ab4544c465b0f","https://github.com/xmldom/xmldom/commit/430357c7b6333108856e917bf2367afe5ceb6f8a","https://github.com/xmldom/xmldom/commit/4845ef109221df0890825de2822fbe77afba3afe","https://github.com/xmldom/xmldom/commit/8834218c85ac2a4d757b9587c9028e67c2f7b6c3","https://github.com/xmldom/xmldom/commit/8b7cfd1491314abdc347261921d7334ff15f7112","https://github.com/xmldom/xmldom/commit/b0620383abc1df067f3ce1014c43ae1bc1161eeb","https://github.com/xmldom/xmldom/commit/e6edcab6bef5bcdba0b220bb35442aa72f452b84","https://github.com/xmldom/xmldom","https://github.com/xmldom/xmldom/releases/tag/0.8.13","https://github.com/xmldom/xmldom/releases/tag/0.9.10"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-2v35-w6hq-6mfw#npm/xmldom","url":"https://osv.dev/vulnerability/GHSA-2v35-w6hq-6mfw"}],"summary":"xmldom: Uncontrolled recursion in XML serialization leads to DoS"}