CVE-2026-83611

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString() can silently accept an end tag such as </a\njunk>, close the element, and discard the trailing content. On 0.9.x, the lib/sax.js end-tag validator inherits the multiline flag from reg(), allowing the first line to satisfy the anchored XML ETag production; older lines have no equivalent residue validation. This parser differential can bypass a parse-before-trust well-formedness gate, although it does not inject the discarded content; onError on 0.9.x and errorHandler on 0.8.x are the relevant reporting interfaces. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString() can silently accept an end tag such as </a\njunk>, close the element, and discard the trailing content. On 0.9.x, the lib/sax.js end-tag validator inherits the multiline flag from reg(), allowing the first line to satisfy the anchored XML ETag production; older lines have no equivalent residue validation. This parser differential can bypass a parse-before-trust well-formedness gate, although it does not inject the discarded content; onError on 0.9.x and errorHandler on 0.8.x are the relevant reporting interfaces. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

Summary

xmldom's parser silently accepts a not-well-formed end tag whose valid name is followed by trailing content — e.g. </a⏎junk>. The element is closed, the trailing content is discarded, and no error is reported, even though the XML end-tag production allows only optional whitespace after the name and both Chromium and Firefox reject such input as application/xml. An application that relies on xmldom to reject not-well-formed input therefore receives a false "valid" result for a document the specification and browsers consider malformed.

Details

Across every affected version, an end tag whose valid Name is followed by trailing content before > is silently accepted: the element is closed, the residue is dropped, and no error is reported. How much leaks differs by line (see Affected Versions), but the observable weakness is the same.

On the current (0.9.x) line, the parser validates the end-tag name against the XML ETag production with an anchored regular expression (^ QName S? $). That expression is compiled with the m (multiline) flag by a shared builder, so $ matches at an interior line terminator: a valid name on the first line satisfies the anchored production and any content after the line break escapes the check. On 0.9.x the whitespace-separated variant (</a junk>) is already rejected; only the line-terminator variant leaks. Older lines have no anchored end-tag validator at all, so they accept both the line-terminator and the whitespace variant.

This is not content injection — the trailing content is dropped, and the resulting DOM is a normal single-root document (<a/>). The security-relevant property is the silent acceptance of not-well-formed input: xmldom's parse result disagrees with the specification and with browser XML parsers, so any control that treats "xmldom parsed it without error" as "well-formed" is bypassed.

Root Cause

On the 0.9.x line, where the line-terminator variant specifically leaks:

1. A shared regexp builder compiles anchored productions with the m flag.
2. ^…$ under m are line anchors, not string anchors.
3. The anchored end-tag production ^ QName S? $ is therefore satisfied by the first line alone, so trailing content after a line terminator is neither matched nor rejected — the malformed end tag is accepted and the residue silently discarded.

The triggering line terminators are the ECMAScript LineTerminator set: U+000A, U+000D, U+2028, U+2029. U+2028 and U+2029 are not XML whitespace, so they are non-conforming trailing content that nonetheless leaks because the JavaScript $ anchor treats them as line boundaries under m.

Affected Versions

Both maintained versions are affected and fixed:

• 0.9.x (>= 0.9.0, <= 0.9.11) → 0.9.12: the anchored end-tag validator's m flag leaks the line-terminator variant. The whitespace variant (</a junk>) is already rejected on this line.
• 0.8.x (>= 0.8.0, <= 0.8.14) → 0.8.15: no anchored end-tag validator at all — both the line-terminator and the whitespace variant are silently accepted; the fix adds a residue check.

release-0.7.x (<= 0.7.13) and the unscoped xmldom package (range *, last release 0.6.0) are affected but will not be patched — they are end-of-life / unmaintained. They share the older-line behavior (both variants silently accepted, residue dropped).

Proof of Concept

const { DOMParser, XMLSerializer } = require('@xmldom/xmldom');
const doc = new DOMParser().parseFromString('<a></a\njunk>', 'text/xml'); // no error
console.log(new XMLSerializer().serializeToString(doc));
// Observed: <a/>   — the malformed end tag is accepted, "junk" silently discarded, no error reported.
// Expected (per XML spec / Chromium / Firefox): a parse error — the input is not well-formed.

Impact

• Silent acceptance of not-well-formed XML: a document the specification and browser XML parsers reject…

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString() can silently accept an end tag such as </a\njunk>, close the element, and discard the trailing content. On 0.9.x, the lib/sax.js end-tag validator inherits the multiline flag from reg(), allowing the first line to satisfy the anchored XML ETag production; older lines have no equivalent residue validation. This parser differential can bypass a parse-before-trust well-formedness gate, although it does not inject the discarded content; onError on 0.9.x and errorHandler on 0.8.x are the relevant reporting interfaces. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString() can silently accept an end tag such as </a\njunk>, close the element, and discard the trailing content. On 0.9.x, the lib/sax.js end-tag validator inherits the multiline flag from reg(), allowing the first line to satisfy the anchored XML ETag production; older lines have no equivalent residue validation. This parser differential can bypass a parse-before-trust well-formedness gate, although it does not inject the discarded content; onError on 0.9.x and errorHandler on 0.8.x are the relevant reporting interfaces. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString() can silently accept an end tag such as </a\njunk>, close the element, and discard the trailing content. On 0.9.x, the lib/sax.js end-tag validator inherits the multiline flag from reg(), allowing the first line to satisfy the anchored XML ETag production; older lines have no equivalent residue validation. This parser differential can bypass a parse-before-trust well-formedness gate, although it does not inject the discarded content; onError on 0.9.x and errorHandler on 0.8.x are the relevant reporting interfaces. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.