CVE-2026-41673

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-674"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41673.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "@xmldom/xmldom >= 0.9.0, < 0.9.10"
                        },
                        {
                            "last_affected": "@xmldom/xmldom >= 0.9.0, < 0.9.10"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandaloneSingleVersion"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/xmldom/xmldom

Affected ranges

Type

GIT

Repo

https://github.com/xmldom/xmldom

Events

Introduced

c80a161172cc4d8733583bf0cf59abfa589f6d9e

Fixed

17678a2a73ecbd1a2da90f3d47dc23da9cef81aa

Fixed

291257493cb0eb6980eda83b162a9c4e6d7d2597

Fixed

2d6d6916ed8a4c223db1f6d7560ab4544c465b0f

Fixed

430357c7b6333108856e917bf2367afe5ceb6f8a

Fixed

4845ef109221df0890825de2822fbe77afba3afe

Fixed

8834218c85ac2a4d757b9587c9028e67c2f7b6c3

Fixed

8b7cfd1491314abdc347261921d7334ff15f7112

Fixed

b0620383abc1df067f3ce1014c43ae1bc1161eeb

Fixed

e6edcab6bef5bcdba0b220bb35442aa72f452b84

Fixed

e5c14802592685bb872c042c54c3f73758875c85

Fixed

bf396a575c4dd32ce4bd925b849dcb7e778d957c

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "xmldom <= 0.6.0"
                },
                {
                    "last_affected": "xmldom <= 0.6.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "@xmldom/xmldom < 0.8.13"
                },
                {
                    "last_affected": "@xmldom/xmldom < 0.8.13"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "fixed": "17678a2a73ecbd1a2da90f3d47dc23da9cef81aa"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "291257493cb0eb6980eda83b162a9c4e6d7d2597"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "2d6d6916ed8a4c223db1f6d7560ab4544c465b0f"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "430357c7b6333108856e917bf2367afe5ceb6f8a"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "4845ef109221df0890825de2822fbe77afba3afe"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "8834218c85ac2a4d757b9587c9028e67c2f7b6c3"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "8b7cfd1491314abdc347261921d7334ff15f7112"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "b0620383abc1df067f3ce1014c43ae1bc1161eeb"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "e6edcab6bef5bcdba0b220bb35442aa72f452b84"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "0.8.13",
            "range": [
                {
                    "fixed": "e5c14802592685bb872c042c54c3f73758875c85"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "0.9.10",
            "range": [
                {
                    "fixed": "bf396a575c4dd32ce4bd925b849dcb7e778d957c"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*

0.6.0

0.7.0

0.7.0+scoped

0.7.0+unscoped

0.7.1

0.7.2

0.7.3

0.8.0

0.8.1

0.8.10

0.8.11

0.8.12

0.8.2

0.8.3

0.8.4

0.8.5

0.8.6

0.8.7

0.8.8

0.8.9

0.9.0

0.9.0-beta.1

0.9.0-beta.10

0.9.0-beta.11

0.9.0-beta.2

0.9.0-beta.3

0.9.0-beta.4

0.9.0-beta.5

0.9.0-beta.6

0.9.0-beta.7

0.9.0-beta.8

0.9.0-beta.9

0.9.1

0.9.2

0.9.3

0.9.4

0.9.5

0.9.6

0.9.7

0.9.8

0.9.9

@xmldom/xmldom < 0.*

@xmldom/xmldom < 0.8.13

v0.*

v0.7.0

xmldom <= 0.*

xmldom <= 0.6.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-41673.json"