{"id":"CVE-2026-83612","aliases":["GHSA-6mj3-qw4j-hgrw"],"url":"https://o3.security/vulnerability/CVE-2026-83612","summary":"xmldom: HTML raw-text closing-tag case mismatch causes output amplification","details":"## Summary\n\nIn HTML mode (`text/html`), a raw-text element (`script`, `style`, `textarea`, `title`) whose closing\ntag differs in case from its opening tag (e.g. `` for `'.repeat(n) + '';\nconst doc = new DOMParser().parseFromString(payload, 'text/html');\nconst out = new XMLSerializer().serializeToString(doc);\nconsole.log(payload.length, out.length, (out.length / payload.length).toFixed(1) + 'x');\n// 18026 9037063 501.3x — an 18 KB input yields ~9 MB of output\n```\n\nOutput size grows quadratically with the number of case-mismatched raw-text elements:\n\n```\nRepeats | Input len | Output len | Ratio\n1 | 44 | 109 | 2.5x\n100 | 1826 | 93763 | 51.3x\n500 | 9026 | 2268563 | 251.3x\n1000 | 18026 | 9037063 | 501.3x\n2000 | 36026 | 36074063 | 1001.3x\n```\n\nProof of Concept from @KarimTantawey (tested with `script`); the same amplification occurs for `style`,\n`textarea`, and `title`.\n\n## Impact\n\nSmall attacker payloads can force disproportionate CPU and memory usage in services that\nparse and serialize untrusted HTML via xmldom. The quadratic growth means a modest-sized input\n(tens of kilobytes) can produce output in the tens or hundreds of megabytes, potentially\nexhausting memory or causing timeouts.\n\nThe attack only requires HTML mode (`text/html` MIME type) and mixed-case closing tags for\nany of the four raw-text element types. No special configuration or error handler setup is needed.\n\n## Severity note\n\nThe CVSS 4.0 vector scores availability only (`VA:H`, with `VC:N/VI:N`): the flaw neither discloses\nnor corrupts data, but a small untrusted HTML input (tens of KB) can force output and memory in the\ntens to hundreds of MB, enough to exhaust a service's heap or stall its event loop. It is reachable\nwith no authentication, configuration, or error-handler setup — only that the application parses\nuntrusted `text/html` and serializes the result.\n\n## Fix Applied\n\nThe raw-text closing tag is now matched case-insensitively in HTML raw-text mode (per the WHATWG HTML\n[RAWTEXT end-tag rule](https://html.spec.whatwg.org/multipage/parsing.html#rawtext-end-tag-name-state)),\nand a missing closing tag is handled explicitly, removing the quadratic output amplification. Output\nfor well-formed input is unchanged. Non-breaking; 0.9.x-only.","published":"2026-09-01T14:36:23.638Z","modified":"2026-10-15T02:47:33.578028226Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"@xmldom/xmldom","fixedVersion":"0.9.12"}],"fix":{"url":"https://github.com/xmldom/xmldom/commit/7ced40c06c28d151e996a97045018c3559ae4707","label":"xmldom/xmldom@7ced40c"},"references":[{"type":"WEB","url":"https://github.com/xmldom/xmldom/releases/tag/0.9.12"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83612.json"},{"type":"ADVISORY","url":"https://github.com/xmldom/xmldom/security/advisories/GHSA-6mj3-qw4j-hgrw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83612"},{"type":"FIX","url":"https://github.com/xmldom/xmldom/commit/7ced40c06c28d151e996a97045018c3559ae4707"},{"type":"FIX","url":"https://github.com/xmldom/xmldom/pull/1071"},{"type":"PACKAGE","url":"https://github.com/xmldom/xmldom"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-15T02:47:33.578028226Z"}}