Sign in
Deutsch English Español Polski
Critical

xmldom allows multiple root nodes in a DOM

  • Disclosed: 01.11.2022
  • Updated: 11.10.2026 10:22

Impact

xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the childNodes collection of the Document, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to https://nvd.nist.gov/vuln/detail/CVE-2022-39299 and is a potential issue for dependents.

Patches

Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next).

Workarounds

One of the following approaches might help, depending on your use case:

  • Instead of searching for elements in the whole DOM, only search in the documentElement.
  • Reject a document with a document that has more then 1 childNode.

References

For more information

If you have any questions or comments about this advisory:

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package xmldom <= 0.6.0 no fix
npm package @xmldom/xmldom < 0.7.7, >= 0.8.0, < 0.8.4, >= 0.9.0-beta.1, < 0.9.0-beta.4 0.7.7, 0.8.4, 0.9.0-beta.4

References

CVSS score 9.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-1288, CWE-20
Platform
npm
Package
xmldom, @xmldom/xmldom
Disclosed
01.11.2022
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-crh6-fp67-6883 - CC BY 4.0

Vulnerability history: @xmldom/xmldom

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (22) in the archive
Total entries
22
First → latest
08.2021 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 18
  • Medium 3

Disclosures per year

Severity:
  1. xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
    High CVE-2026-83616 >= 0.7.0, < 0.8.15, >= 0.9.0, < 0.9.12 0.8.15, 0.9.12
  2. xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
    High CVE-2026-83617 >= 0.9.11, < 0.9.12 0.9.12
  3. xmldom: DocType `name` Injection Bypasses requireWellFormed
    High CVE-2026-83608 >= 0.7.0, < 0.8.15, >= 0.9.0, < 0.9.12 0.8.15, 0.9.12
  4. xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
    High CVE-2026-83609 >= 0.9.0, < 0.9.12 0.9.12
  5. xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
    High CVE-2026-83618 >= 0.9.10, < 0.9.12 0.9.12
  6. xmldom: Quadratic-time attribute deduplication
    High CVE-2026-83613 >= 0.7.0, < 0.8.15, >= 0.9.0, < 0.9.12 0.8.15, 0.9.12
  7. xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser
    High CVE-2026-83619 >= 0.7.0, < 0.8.15 0.8.15
  8. xmldom: Quadratic-memory consumption
    High CVE-2026-83615 >= 0.7.0, < 0.8.15, >= 0.9.0, < 0.9.12 0.8.15, 0.9.12
  9. xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
    High CVE-2026-83614 >= 0.7.0, < 0.8.15, >= 0.9.0, < 0.9.12 0.8.15, 0.9.12
  10. xmldom: HTML raw-text closing-tag case mismatch causes output amplification
    High CVE-2026-83612 >= 0.9.0-beta.1, < 0.9.12 0.9.12
  11. xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
    High CVE-2026-83606 >= 0.9.0-beta.9, < 0.9.11 0.9.11
  12. xmldom: Element name injection via createElement() bypasses requireWellFormed
    High CVE-2026-83607 >= 0.9.0, < 0.9.11, >= 0.7.0, < 0.8.14 0.9.11, 0.8.14
  13. xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
    High CVE-2026-83605 >= 0.9.0, < 0.9.11, >= 0.7.0, < 0.8.14 0.9.11, 0.8.14
  14. xmldom: Uncontrolled recursion in XML serialization leads to DoS
    High CVE-2026-41673 < 0.8.13, >= 0.9.0, < 0.9.10 0.8.13, 0.9.10
  15. xmldom has XML injection through unvalidated DocumentType serialization
    High CVE-2026-41674 < 0.8.13, >= 0.9.0, < 0.9.10 0.8.13, 0.9.10
  16. xmldom has XML node injection through unvalidated processing instruction serialization
    High CVE-2026-41675 < 0.8.13, >= 0.9.0, < 0.9.10 0.8.13, 0.9.10
  17. xmldom has XML node injection through unvalidated comment serialization
    High CVE-2026-41672 < 0.8.13, >= 0.9.0, < 0.9.10 0.8.13, 0.9.10
  18. xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
    High · 7.5 CVE-2026-34601 < 0.8.12, >= 0.9.0, < 0.9.9 0.8.12, 0.9.9
  19. xmldom allows multiple root nodes in a DOM this entry
    Critical · 9.8 CVE-2022-39353 < 0.7.7, >= 0.8.0, < 0.8.4, >= 0.9.0-beta.1, < 0.9.0-beta.4 0.7.7, 0.8.4, 0.9.0-beta.4

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.