CVE Feed

    Dashboard / CVE / CVE-2026-41673

    CVE-2026-41673

    xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

    Published:May 7, 2026
    Last Modified:Aug 28, 2026
    EPS:May 7, 2026
    EPSS Score:0.00643
    CVSS Score:7.5

    Affected Products

    Vendor
    Xmldom
    Product
    Xmldom

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-83619 (CVSS 8.7) — xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From…
    CVE-2026-83618 (CVSS 8.7) — xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From…
    CVE-2026-83617 (CVSS 8.7) — xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From…
    CVE-2026-83616 (CVSS 8.7) — xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prio…
    CVE-2026-83615 (CVSS 8.7) — xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prio…
    CVE-2026-83614 (CVSS 8.7) — xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prio…
    CVE-2026-83613 (CVSS 8.7) — xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prio…
    CVE-2026-83612 (CVSS 8.7) — xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From…
    CVE-2026-83611 (CVSS 6.9) — xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prio…
    CVE-2026-83610 (CVSS 6.3) — xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prio…

    References

    https://github.com/xmldom/xmldom/commit/17678a2a73ecbd1a2da90f3d47dc23da9cef81aa
    https://github.com/xmldom/xmldom/commit/291257493cb0eb6980eda83b162a9c4e6d7d2597
    https://github.com/xmldom/xmldom/commit/2d6d6916ed8a4c223db1f6d7560ab4544c465b0f
    https://github.com/xmldom/xmldom/commit/430357c7b6333108856e917bf2367afe5ceb6f8a
    https://github.com/xmldom/xmldom/commit/4845ef109221df0890825de2822fbe77afba3afe
    https://github.com/xmldom/xmldom/commit/8834218c85ac2a4d757b9587c9028e67c2f7b6c3
    https://github.com/xmldom/xmldom/commit/8b7cfd1491314abdc347261921d7334ff15f7112
    https://github.com/xmldom/xmldom/commit/b0620383abc1df067f3ce1014c43ae1bc1161eeb
    https://github.com/xmldom/xmldom/commit/e6edcab6bef5bcdba0b220bb35442aa72f452b84
    https://github.com/xmldom/xmldom/releases/tag/0.8.13
    https://github.com/xmldom/xmldom/releases/tag/0.9.10
    https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw
    https://access.redhat.com/errata/RHSA-2026:26234
    https://access.redhat.com/errata/RHSA-2026:60520
    https://access.redhat.com/security/cve/CVE-2026-41673
    https://bugzilla.redhat.com/show_bug.cgi?id=2467630
    https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw
    https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41673.json

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High