CVE-2026-83619

About vulnerability

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression /[ \t\n\r]+$/g. For an end tag containing a long whitespace run followed by a non-whitespace character, the expression retries from each possible starting position and backtracks quadratically before failing its end anchor. DOMParser.parseFromString() reaches the path under default options, allowing a small unauthenticated XML input to stall the Node.js event loop; the 0.9.x and unscoped npm lines do not contain this expression. This issue is fixed in @xmldom/xmldom version 0.8.15.

Affected product:

@bacons/xcode , @expo/build-tools , React , babel-preset-expo , config-plugins , create-expo-module , eslint-config-expo , eslint-config-universe , expo , expo-ads-admob , expo-ads-facebook , expo-app-auth , expo-app-integrity , expo-app-loading , expo-apple-authentication , expo-asset , expo-auth-session , expo-av , expo-background-fetch , expo-barcode-scanner , expo-blur , expo-branch , expo-brightness , expo-build-properties , expo-calendar , expo-camera , expo-config , expo-constants , expo-contacts , expo-crypto , expo-dev-client , expo-dev-client-components , expo-dev-launcher , expo-dev-menu , expo-dev-server , expo-dev-tools , expo-document-picker , expo-env-info , expo-error-recovery , expo-expo-cli , expo-file-system , expo-firebase-analytics , expo-firebase-core , expo-firebase-recaptcha , expo-font , expo-gl , expo-google-app-auth , expo-image , expo-image-picker , expo-image-utils , expo-intent-launcher , expo-keep-awake , expo-linear-gradient , expo-linking , expo-local-authentication , expo-location , expo-manifests , expo-maps , expo-media-library , expo-mesh-gradient , expo-metro-config , expo-module-scripts , expo-modules-autolinking , expo-modules-core , expo-modules-jsi , expo-modules-test-core , expo-navigation-bar , expo-network , expo-network-addons , expo-next-adapter , expo-notifications , expo-payments-stripe , expo-plist , expo-prebuild-config , expo-print , expo-pwa , expo-router , expo-schemer , expo-screen-capture , expo-screen-orientation , expo-sensors , expo-sharing , expo-splash-screen , expo-sqlite , expo-standard-web-crypto , expo-status-bar , expo-symbols , expo-system-ui , expo-task-manager , expo-template-bare-minimum , expo-template-blank , expo-template-blank-typescript , expo-template-default , expo-template-tabs , expo-tracking-transparency , expo-updates , expo-web-browser , expo-webpack-config , expo-widgets , expo-yarn-workspaces , hiero-sdk-js , install-expo-modules , jest-expo , jest-expo-enzyme , ledger-live , ledgerhq-coin-algorand , ledgerhq-coin-aptos , ledgerhq-coin-canton , ledgerhq-coin-concordium , ledgerhq-coin-cosmos , ledgerhq-coin-near , ledgerhq-coin-polkadot , ledgerhq-domain-service , ledgerhq-hw-app-near , ledgerhq-hw-transport , ledgerhq-hw-transport-mocker , ledgerhq-hw-transport-node-hid-noevents , ledgerhq-hw-transport-node-speculos , ledgerhq-hw-transport-web-ble , ledgerhq-hw-transport-webusb , ledgerhq-live-common , onnxruntime-common , patch-project , unimodules-permissions-interface , unimodules-sensors-interface , unimodules-task-manager-interface , xdl , xmldom-xmldom

Affected packages:

@xmldom/xmldom @ 0.8.13 (+1923 more)