{"action":"Upgrade @xmldom/xmldom to 0.8.15 or later.","affected":[{"fixed":"0.8.15","introduced":"0.7.0"}],"component":"@xmldom/xmldom","cve_ids":["CVE-2026-83619"],"ecosystem":"npm","epss":0.00524,"exploited":false,"fixed_versions":["0.8.15"],"ghsa_id":"GHSA-x4fp-j954-r2f4","id":"tcs_01M5KGGVXHG294H1K62Y15BXQ0","modified_at":"2026-09-08T21:15:04.998562447Z","published_at":"2026-09-08T21:01:09Z","references":["https://osv.dev/vulnerability/GHSA-x4fp-j954-r2f4","https://github.com/xmldom/xmldom/security/advisories/GHSA-x4fp-j954-r2f4","https://nvd.nist.gov/vuln/detail/CVE-2026-83619","https://github.com/xmldom/xmldom/pull/1072","https://github.com/xmldom/xmldom/commit/3abb0934f5a8a84d83a1f9cde0f2bd04c08b2a09","https://github.com/xmldom/xmldom","https://github.com/xmldom/xmldom/releases/tag/0.8.15"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-x4fp-j954-r2f4","url":"https://osv.dev/vulnerability/GHSA-x4fp-j954-r2f4"},{"source":"nvd","source_id":"CVE-2026-83619","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83619"}],"summary":"xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser"}