8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41673

CVE-2026-41673: xmldom: Denial of service via uncontrolled recursion in XML serialization

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41673

CVE-2026-41673:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@xmldom/xmldom	npm	< 0.8.13	0.8.13
@xmldom/xmldom	npm	>= 0.9.0, < 0.9.10	0.9.10
xmldom	npm	<= 0.6.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is rooted in seven different DOM operations within lib/dom.js that were implemented using recursive tree traversal without any depth limit. When these operations are performed on a deeply nested XML document, the JavaScript call stack is exhausted, leading to a RangeError: Maximum call stack size exceeded which crashes the Node.js process, causing a denial of service. The vulnerable functions include normalize, serializeToString, cloneNode, importNode, isEqualNode, the textContent getter, and the internal _visitNode function (used by getElementsByTagName, getElementsByTagNameNS, getElementsByClassName, and getElementById). The fix, applied across multiple commits, was to replace these recursive implementations with iterative ones. A new walkDOM utility, which uses an explicit stack (heap memory) instead of the call stack, was introduced and used to refactor six of the seven functions. The seventh, isEqualNode, required a custom iterative implementation because it needs to traverse two trees in parallel. By analyzing the removal of the recursive calls in the patch files, the specific vulnerable functions were identified.

Vulnerable functions

Node.prototype.normalize

lib/dom.js

The `normalize` function recursively calls itself on child nodes (`child.normalize()`) without any depth limit, leading to a stack exhaustion denial of service when processing a deeply nested XML document.

XMLSerializer.prototype.serializeToString

lib/dom.js

The `serializeToString` method internally used a recursive helper function that would call itself for each node in the DOM tree. A deeply nested XML document would cause this recursion to exceed the maximum call stack size, resulting in a process crash.

_visitNode

lib/dom.js

The internal helper function `_visitNode` used recursion to traverse the DOM tree (`if (_visitNode(node, callback))`). This function is called by `getElementsByTagName`, `getElementsByTagNameNS`, `getElementsByClassName`, and `getElementById`, making them vulnerable to stack exhaustion on deep trees.

Node.prototype.cloneNode

lib/dom.js

When cloning a node with the `deep` flag set to `true`, the `cloneNode` function would recursively call itself for all descendant nodes. This leads to a stack overflow when cloning a deeply nested node.

Document.prototype.importNode

lib/dom.js

When importing a node with the `deep` flag set to `true`, the `importNode` function recursively called itself for all child nodes (`node2.appendChild(importNode(doc, child, deep));`), leading to a stack overflow on deeply nested structures.

Node.prototype.textContent

lib/dom.js

The getter for the `textContent` property used a recursive helper function, `getTextContent`, to concatenate the text of all child nodes. For a deeply nested element, this recursion would exhaust the call stack.

Node.prototype.isEqualNode

lib/dom.js

The `isEqualNode` function performed a recursive comparison of all child nodes. When comparing two deeply nested, identical nodes, this recursion would lead to a stack overflow.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.