THREAT OPS › Threat News › [GHSA] GHSA-6mj3-qw4j-hgrw (high) — xmldom: HTML raw-text closing-tag case mismatch causes output amplification
[GHSA] GHSA-6mj3-qw4j-hgrw (high) — xmldom: HTML raw-text closing-tag case mismatch causes output amplification
GHSA-6mj3-qw4j-hgrw Severity: high CVE: CVE-2026-83612
xmldom: HTML raw-text closing-tag case mismatch causes output amplification
## Summary
In HTML mode (`text/html`), a raw-text element (`script`, `style`, `textarea`, `title`) whose closing tag differs in case from its opening tag (e.g. `</ScRiPt>` for `<script>`) is mishandled by the parser, producing quadratic (O(n²)) output growth — a sma
Indicators of compromise
- CVE-2026-83612cve
- https://html.spec.whatwg.org/multipage/parsing.html#rawtext-end-tag-name-stateurl
Original source: https://github.com/advisories/GHSA-6mj3-qw4j-hgrw