Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-83605
By Stav Salman |
9 September 2026
Multiple CVEs – @xmldom/xmldom XML well-formedness validation bypass enables name/doctype injection and DoS
Multiple High issues in @xmldom/xmldom allow bypassing requireWellFormed via embedded line terminators, enabling element/attribute/DocType/PI target injection on default serialization paths. Additional flaws trigger ReDoS (quadratic backtracking) and quadratic time/memory parsing. patch to 0.9.12 to remediate all CVEs.
CVE IDs: CVE-2026-83605, CVE-2026-83606, CVE-2026-83607, CVE-2026-83608, CVE-2026-83609, CVE-2026-83612, CVE-2026-83613, CVE-2026-83614, CVE-2026-83615, CVE-2026-83616, CVE-2026-83617, CVE-2026-83618, CVE-2026-83619.