Listen to this Post
The vulnerability exists in the processing-instruction (PI) grammar regex defined in lib/grammar.js. The regex `^<\?(NameChars)(?:[\x20\x09\x0D\x0A]+([bash]?))?\?>` compiles with the `mu` flags. Inside the optional tail group (?:S+(Char?))?, the subpattern `S+` is greedy and matches one or more XML whitespace characters, while `Char?` is lazy and matches zero or more characters (including whitespace) non-greedily. When the parser encounters an unterminated PI—for example, `?>—the required trailing delimiter is absent. To determine that the match cannot succeed, the regex engine must explore every possible partition of the whitespace run between the greedy `S+` and the lazy Char?. Because both subpatterns can consume whitespace, the engine backtracks over all splits, producing O(n²) work where n is the length of the trailing whitespace.
This regex is applied against the full remaining source string in two locations within lib/sax.js: the `parsePI` function (line 680–691) and the `parseProcessingInstruction` function (line 862–879). The entire whitespace tail is scanned repeatedly during backtracking. The affected versions are exclusively the 0.9.x line, from 0.9.0-beta.9 through 0.9.10, where this grammar was introduced in commit 726b471. The older 0.8.x branch (≤0.8.13) and the unscoped `xmldom` package (≤0.6.0) use a different parsing path bounded by indexOf('?>'), which does not contain this regex and is not vulnerable.
A proof-of-concept payload with 32 KB of whitespace after `S+, preventing the separator from handing whitespace back to the lazy data group. This eliminates backtracking, reduces parsing to linear time (~0.4 ms at 128 KB), and preserves all valid PI parsing behaviour.
DailyCVE Form:
Platform: Node.js @xmldom/xmldom
Version: 0.9.0-beta.9 – 0.9.10
Vulnerability : ReDoS (quadratic backtracking)
Severity: High (VA:H)
date: Oct 2022
Prediction: Already patched (0.9.11)
What Undercode Say:
Verify vulnerable version
npm list @xmldom/xmldom
PoC timing test (save as poc.js)
const { DOMParser } = require(‘@xmldom/xmldom’);
const n = 32 1024;
<
h2 style=”color: blue;”>const payload = ‘
After upgrading to 0.9.11, the same test runs in <5ms
curl -X POST http://target-xml-api/parse \ – Upgrade @xmldom/xmldom to 0.9.11 or later immediately. Availability-only: a single crafted XML document (≈32 KB) stalls the Node.js event loop for ~1 second; larger inputs (hundreds of KB) cause multi-second freezes. No memory corruption, data exposure, or code execution. The attack vector is wide because XML is commonly parsed from untrusted sources using default options, allowing remote unauthenticated attackers to degrade or fully deny service to the affected application. Join Undercode Academy for Verified Certifications Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems: Reported By: github.comconsole.time(‘parse’);
new DOMParser().parseFromString(payload, ‘text/xml’);
console.timeEnd(‘parse’);
Run with Node.js
node poc.js
Expected output: parse: ~1000ms (or more)
Check installed version
npm show @xmldom/xmldom version
Exploit: (Educational Purposes!)
-H “Content-Type: application/xml” \
-d “Multiple concurrent requests can amplify the denial-of-service,
as each parse blocks the thread without yielding.
Protection:
– If upgrade is not possible, apply a maximum XML input size limit (e.g., 10 KB) at the application gateway.
– Use a streaming XML parser that does not rely on backtracking regexes, or switch to a different XML library (e.g., sax-js, libxmljs) with bounded parsing.
– Deploy a Web Application Firewall (WAF) to detect and block XML payloads containing ``.Impact:
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
🚀 Request a Custom Project:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by ThousandsSources:
Extra Source Hub:
Undercode🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow DailyCVE & Stay Tuned:
