npm / @xmldom/xmldom

@xmldom/xmldom

What changed in @xmldom/xmldom 0.8 to 0.9, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.

5 breaking18 security1 deprecations1 new APIs and options5 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

@xmldom/xmldom 0.928 changes

Breaking changes 5

Name creation rejects names containing a line terminator with InvalidCharacterError; the same validation change applies to createAttributeNS, createDocumentType, and createAttribute.
0.9.12release notes security advisory
Creation now rejects invalid XML Names; requireWellFormed serialization also validates EntityReference nodeName and throws InvalidStateError for invalid names.
0.8.15, 0.9.12release notes security advisory
Malformed tag-name scanning now terminates at an embedded <, avoiding quadratic recovery behavior; DOM output is unchanged, but reported error text can differ.
0.8.15, 0.9.12release notes security advisory
With requireWellFormed enabled, serialization validates processing-instruction targets as XML NCNames and rejects case-insensitive xml, throwing InvalidStateError.
0.8.15, 0.9.12release notes security advisory
With requireWellFormed enabled, serialization now rejects invalid element and attribute names that are not valid XML QNames, preventing XML injection.
0.8.14, 0.9.11release notes security advisory security advisory

Security 17

Parsing duplicate attributes is now O(M) rather than O(M²), preventing hostile numbers of duplicate attributes from wedging the parse while preserving attribute order and duplicate resolution.
0.8.15, 0.9.12release notes security advisory release notes
Parsing deeply or repeatedly namespaced documents now uses linear rather than quadratic memory, preventing a denial-of-service with default options.
0.8.15, 0.9.12release notes security advisory
An end tag with a valid name followed by trailing content now reports a recoverable error instead of being silently accepted; parsing recovers to the same DOM, and errorHandler can escalate it to fatal.
0.8.15, 0.9.12release notes security advisory
End tags with a valid name followed by trailing content now report a recoverable XML error or HTML warning instead of being silently accepted; parsing still recovers to the same DOM.
0.8.15, 0.9.12release notes security advisory
Closing tags are matched case-insensitively and missing closing tags are handled explicitly, preventing output amplification and denial-of-service.
0.9.12release notes security advisory
Malformed tag-name scanning and Node.prototype.normalize() now run in linear time rather than quadratic time; DOM output is unchanged, though reported error text may differ.
0.8.15, 0.9.12release notes security advisory
Deeply or repeatedly namespaced documents now use O(N) rather than O(N²) memory during parsing, preventing a denial-of-service through DOMParser.parseFromString with default options.
0.8.15, 0.9.12release notes security advisory
Adjacent text nodes are now merged in linear rather than quadratic time, including when normalize is called programmatically.
0.8.15, 0.9.12release notes security advisory
With requireWellFormed enabled, serialization rejects a DocType name that is not a valid XML Name by throwing InvalidStateError.
0.8.15, 0.9.12release notes security advisory
Element- and attribute-name validation now rejects names containing an interior line terminator, closing a QName-check bypass.
0.9.12release notes security advisory
DocType publicId and systemId validation now rejects identifiers containing an ECMAScript line terminator.
0.9.12release notes security advisory
With requireWellFormed enabled, serialization validates EntityReference nodeName as an XML Name and throws InvalidStateError for invalid names.
0.8.15, 0.9.12release notes security advisory
The processing-instruction grammar regex no longer backtracks quadratically on unterminated processing instructions, preventing a denial-of-service with default parser options.
0.9.11release notes security advisory
DOM traversal operations are iterative, so deeply nested DOM trees no longer exhaust the JavaScript call stack and throw an unrecoverable RangeError.
0.8.13, 0.9.10release notes release notes security advisory
Serializer methods accept requireWellFormed; when true, serialization throws InvalidStateError for injection-prone node content, helping prevent XML injection.
0.8.13, 0.9.10release notes release notes security advisory security advisory security advisory
Passing data containing "]]>" now throws InvalidCharacterError, as required by the WHATWG DOM spec.
0.8.12, 0.9.9release notes security advisory
CDATASection nodes containing "]]>" are split into adjacent CDATA sections during serialization, preventing XML injection via mutation methods.
0.8.12, 0.9.9release notes security advisory

Deprecations 1

The serializer option is deprecated and will be removed in the next breaking release; use requireWellFormed: true or ensure CDATASection data does not contain ]]> before serialization.
0.9.10release notes

New APIs and options 1

Adds the ParentNode.children getter.
0.9.9release notes

Fixes and other changes 4

DOMExceptions raised during parsing are reported as fatalError, and the originating error is preserved as the resulting ParseError's cause.
0.9.12release notes
CharacterData nodeValue and data are now kept in sync.
0.9.11release notes
isEqualNode now returns false when comparing CDATASection nodes with different data.
0.9.10release notes
Correctly traverses the ancestor chain.
0.9.9release notes

@xmldom/xmldom 0.82 changes

Security 1

xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser
0.8.15security advisory

Fixes and other changes 1

Trailing whitespace in ProcessingInstruction data is now preserved.
0.8.12release notes