THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-g53g-w8rj-fmg7 (high) — xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

[GHSA] GHSA-g53g-w8rj-fmg7 (high) — xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

highgithub_advisoriesPublished 2026-09-08

GHSA-g53g-w8rj-fmg7 Severity: high CVE: CVE-2026-83606

xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

## Summary

`@xmldom/xmldom`'s processing-instruction (PI) grammar regex exhibits quadratic-time backtracking (ReDoS) when parsing an **unterminated** processing instruction. A single small XML document containing `<?` + a target + a long run of whi

Indicators of compromise

Original source: https://github.com/advisories/GHSA-g53g-w8rj-fmg7