Uncontrolled Recursion
CVE-2026-41673
Summary
Seven recursive traversals in `lib/dom.js` operate without a depth limit. A sufficiently deeply nested DOM tree causes a `RangeError: Maximum call stack size exceeded`, crashing the application. The affected versions are through 0.8.12 and 0.9.0 through 0.9.10 in '@xmldom/xmldom' and versions through 0.6.0 in xmldom.
- LOW
- NETWORK
- NONE
- NONE
CWE-674 - Uncontrolled Recursion
The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.
References
Advisory Timeline
- Published
