# What changed in @xmldom/xmldom

> 30 changes in @xmldom/xmldom 0.8 to 0.9 from its official release notes, upgrade guides and advisories: 5 breaking, 1 deprecations, 18 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/@xmldom/xmldom/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @xmldom/xmldom 0.9

### Breaking changes

- Name creation rejects names containing a line terminator with InvalidCharacterError; the same validation change applies to createAttributeNS, createDocumentType, and createAttribute. (0.9.12) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.9.12), [security advisory](https://github.com/advisories/GHSA-3PX3-54CX-RMW9)
- Creation now rejects invalid XML Names; requireWellFormed serialization also validates EntityReference nodeName and throws InvalidStateError for invalid names. (0.8.15, 0.9.12) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.9.12), [security advisory](https://github.com/advisories/GHSA-6GMQ-8VP8-GCM6)
- Malformed tag-name scanning now terminates at an embedded `<`, avoiding quadratic recovery behavior; DOM output is unchanged, but reported error text can differ. (0.8.15, 0.9.12) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.9.12), [security advisory](https://github.com/advisories/GHSA-93R5-FHX6-VMG9)
- With requireWellFormed enabled, serialization validates processing-instruction targets as XML NCNames and rejects case-insensitive `xml`, throwing InvalidStateError. (0.8.15, 0.9.12) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.9.12), [security advisory](https://github.com/advisories/GHSA-C7Q8-3CH8-VQPV)
- With requireWellFormed enabled, serialization now rejects invalid element and attribute names that are not valid XML QNames, preventing XML injection. (0.8.14, 0.9.11) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.8.14), [security advisory](https://github.com/advisories/GHSA-4W3W-2RP5-G8JM), [security advisory](https://github.com/advisories/GHSA-W2RR-34G9-RVRJ)

### Security

- Parsing duplicate attributes is now O(M) rather than O(M²), preventing hostile numbers of duplicate attributes from wedging the parse while preserving attribute order and duplicate resolution. (0.8.15, 0.9.12) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.8.15), [security advisory](https://github.com/advisories/GHSA-8344-3JMQ-59R6), [release notes](https://github.com/xmldom/xmldom/releases/tag/0.9.12)
- Parsing deeply or repeatedly namespaced documents now uses linear rather than quadratic memory, preventing a denial-of-service with default options. (0.8.15, 0.9.12) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.9.12), [security advisory](https://github.com/advisories/GHSA-965W-775F-MR7G)
- An end tag with a valid name followed by trailing content now reports a recoverable error instead of being silently accepted; parsing recovers to the same DOM, and errorHandler can escalate it to fatal. (0.8.15, 0.9.12) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.8.15), [security advisory](https://github.com/advisories/GHSA-6H8R-XR42-GP59)
- End tags with a valid name followed by trailing content now report a recoverable XML error or HTML warning instead of being silently accepted; parsing still recovers to the same DOM. (0.8.15, 0.9.12) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.9.12), [security advisory](https://github.com/advisories/GHSA-6H8R-XR42-GP59)
- Closing tags are matched case-insensitively and missing closing tags are handled explicitly, preventing output amplification and denial-of-service. (0.9.12) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.9.12), [security advisory](https://github.com/advisories/GHSA-6MJ3-QW4J-HGRW)
- Malformed tag-name scanning and Node.prototype.normalize() now run in linear time rather than quadratic time; DOM output is unchanged, though reported error text may differ. (0.8.15, 0.9.12) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.8.15), [security advisory](https://github.com/advisories/GHSA-93R5-FHX6-VMG9)
- Deeply or repeatedly namespaced documents now use O(N) rather than O(N²) memory during parsing, preventing a denial-of-service through DOMParser.parseFromString with default options. (0.8.15, 0.9.12) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.8.15), [security advisory](https://github.com/advisories/GHSA-965W-775F-MR7G)
- Adjacent text nodes are now merged in linear rather than quadratic time, including when normalize is called programmatically. (0.8.15, 0.9.12) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.9.12), [security advisory](https://github.com/advisories/GHSA-93R5-FHX6-VMG9)
- With requireWellFormed enabled, serialization rejects a DocType name that is not a valid XML Name by throwing InvalidStateError. (0.8.15, 0.9.12) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.9.12), [security advisory](https://github.com/advisories/GHSA-27P8-2357-5QQV)
- Element- and attribute-name validation now rejects names containing an interior line terminator, closing a QName-check bypass. (0.9.12) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.9.12), [security advisory](https://github.com/advisories/GHSA-JXJR-3G7G-3944)
- DocType publicId and systemId validation now rejects identifiers containing an ECMAScript line terminator. (0.9.12) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.9.12), [security advisory](https://github.com/advisories/GHSA-VR34-HP96-76PP)
- With requireWellFormed enabled, serialization validates EntityReference nodeName as an XML Name and throws InvalidStateError for invalid names. (0.8.15, 0.9.12) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.8.15), [security advisory](https://github.com/advisories/GHSA-6GMQ-8VP8-GCM6)
- The processing-instruction grammar regex no longer backtracks quadratically on unterminated processing instructions, preventing a denial-of-service with default parser options. (0.9.11) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.9.11), [security advisory](https://github.com/advisories/GHSA-G53G-W8RJ-FMG7)
- DOM traversal operations are iterative, so deeply nested DOM trees no longer exhaust the JavaScript call stack and throw an unrecoverable RangeError. (0.8.13, 0.9.10) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.9.10), [release notes](https://github.com/xmldom/xmldom/releases/tag/0.8.13), [security advisory](https://github.com/advisories/GHSA-2V35-W6HQ-6MFW)
- Serializer methods accept requireWellFormed; when true, serialization throws InvalidStateError for injection-prone node content, helping prevent XML injection. (0.8.13, 0.9.10) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.9.10), [release notes](https://github.com/xmldom/xmldom/releases/tag/0.8.13), [security advisory](https://github.com/advisories/GHSA-F6WW-3GGP-FR8H), [security advisory](https://github.com/advisories/GHSA-J759-J44W-7FR8), [security advisory](https://github.com/advisories/GHSA-X6WF-F3PX-WCQX)
- Passing data containing "]]>" now throws InvalidCharacterError, as required by the WHATWG DOM spec. (0.8.12, 0.9.9) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.8.12), [security advisory](https://github.com/advisories/GHSA-WH4C-J3R5-MJHP)
- CDATASection nodes containing "]]>" are split into adjacent CDATA sections during serialization, preventing XML injection via mutation methods. (0.8.12, 0.9.9) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.8.12), [security advisory](https://github.com/advisories/GHSA-WH4C-J3R5-MJHP)

### Deprecations

- The serializer option is deprecated and will be removed in the next breaking release; use requireWellFormed: true or ensure CDATASection data does not contain ]]> before serialization. (0.9.10) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.9.10)

### New APIs and options

- Adds the ParentNode.children getter. (0.9.9) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.9.9)

### Fixes and other changes

- DOMExceptions raised during parsing are reported as fatalError, and the originating error is preserved as the resulting ParseError's cause. (0.9.12) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.9.12)
- CharacterData nodeValue and data are now kept in sync. (0.9.11) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.9.11)
- isEqualNode now returns false when comparing CDATASection nodes with different data. (0.9.10) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.9.10)
- Correctly traverses the ancestor chain. (0.9.9) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.9.9)

## @xmldom/xmldom 0.8

### Security

- xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser (0.8.15) — [security advisory](https://github.com/advisories/GHSA-X4FP-J954-R2F4)

### Fixes and other changes

- Trailing whitespace in ProcessingInstruction data is now preserved. (0.8.12) — [release notes](https://github.com/xmldom/xmldom/releases/tag/0.8.12)