# xmldom changelog

> A pure-JavaScript W3C standard DOM parser and serializer for XML.

- Vendor: xmldom
- Category: Frameworks & Libraries
- Official site: https://github.com/xmldom/xmldom
- Tracked by: What's New (https://whatsnew.fyi/product/xmldom)
- Harvested from: GitHub (xmldom/xmldom)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### 0.9.11

- Date: 2026-08-12
- Version: 0.9.11
- Original notes: https://github.com/xmldom/xmldom/releases/tag/0.9.11
- Permalink: https://whatsnew.fyi/product/xmldom/releases/0.9.11

- **security** — XMLSerializer.serializeToString() now rejects invalid element and attribute names when requireWellFormed is true, throwing InvalidStateError for names that are not valid XML QNames, preventing XML injection via createElement() and setAttribute()
- **security** — Processing-instruction grammar regex no longer backtracks quadratically on unterminated processing instructions, preventing denial-of-service attacks reachable from DOMParser.parseFromString()
- **fixed** — CharacterData nodeValue and data are now kept in sync

[Commits](https://github.com/xmldom/xmldom/compare/0.9.10...0.9.11)

###### Fixed

- Security: `XMLSerializer.serializeToString()` now also rejects invalid element and attribute names when `{ requireWellFormed: true }` is passed, throwing `InvalidStateError` for a name that is not a valid XML [`QName`](https://www.w3.org/TR/xml-names/#NT-QName) (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized `xmlns:` declaration). This prevents XML injection via `createElement()` / `setAttribute()`, extending the existing `requireWellFormed` checks to the serialized name set. [`GHSA-w2rr-34g9-rvrj`](https://github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrj) [`GHSA-4w3w-2rp5-g8jm`](https://github.com/xmldom/xmldom/security/advisories/GHSA-4w3w-2rp5-g8jm)
- Security: the processing-instruction grammar regex no longer backtracks quadratically on an unterminated processing instruction (`<?…` with no closing `?>`), preventing a denial-of-service (ReDoS) reachable from `DOMParser.parseFromString` with default options. [`GHSA-g53g-w8rj-fmg7`](https://github.com/xmldom/xmldom/security/advisories/GHSA-g53g-w8rj-fmg7)
- `CharacterData` `nodeValue` and `data` are now kept in sync [`#990`](https://github.com/xmldom/xmldom/pull/990)

###### Chore

- updated dependencies

Thank you,
[@bhaswanthc](https://github.com/bhaswanthc),
[@jmestwa-coder](https://github.com/jmestwa-coder),
[@stevenobiajulu](https://github.com/stevenobiajulu),
for your contributions

### 0.8.14

- Date: 2026-08-12
- Version: 0.8.14
- Original notes: https://github.com/xmldom/xmldom/releases/tag/0.8.14
- Permalink: https://whatsnew.fyi/product/xmldom/releases/0.8.14

- **security** — XMLSerializer.serializeToString() now rejects invalid element and attribute names when requireWellFormed: true is passed, throwing InvalidStateError for names that are not valid XML QNames, preventing XML injection via createElement() and setAttribute()

[Commits](https://github.com/xmldom/xmldom/compare/0.8.13...0.8.14)

###### Fixed

- Security: `XMLSerializer.serializeToString()` now also rejects invalid element and attribute names when `{ requireWellFormed: true }` is passed, throwing `InvalidStateError` for a name that is not a valid XML [`QName`](https://www.w3.org/TR/xml-names/#NT-QName) (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized `xmlns:` declaration). This prevents XML injection via `createElement()` / `setAttribute()`, extending the existing `requireWellFormed` checks to the serialized name set. [`GHSA-w2rr-34g9-rvrj`](https://github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrj) [`GHSA-4w3w-2rp5-g8jm`](https://github.com/xmldom/xmldom/security/advisories/GHSA-4w3w-2rp5-g8jm)

Thank you,
[@bhaswanthc](https://github.com/bhaswanthc),
[@jmestwa-coder](https://github.com/jmestwa-coder),
for your contributions

### 0.9.10

- Date: 2026-04-18
- Version: 0.9.10
- Original notes: https://github.com/xmldom/xmldom/releases/tag/0.9.10
- Permalink: https://whatsnew.fyi/product/xmldom/releases/0.9.10

- **security** — XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option that throws InvalidStateError for injection-prone node content when enabled
- **security** — DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById(), Node.prototype.isEqualNode()) are now iterative to prevent stack exhaustion on deeply nested DOM trees
- **fixed** — isEqualNode now correctly returns false for CDATASection nodes with different data
- **deprecated** — The splitCDATASections serializer option is deprecated and will be removed in the next breaking release

[Commits](https://github.com/xmldom/xmldom/compare/0.9.9...0.9.10)

###### Fixed

- Security: `XMLSerializer.serializeToString()` (and `Node.toString()`, `NodeList.toString()`) now accept a `requireWellFormed` option. When `{ requireWellFormed: true }` is passed, the serializer throws `InvalidStateError` for injection-prone node content, preventing XML injection via attacker-controlled node data. [`GHSA-j759-j44w-7fr8`](https://github.com/xmldom/xmldom/security/advisories/GHSA-j759-j44w-7fr8) [`GHSA-x6wf-f3px-wcqx`](https://github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx) [`GHSA-f6ww-3ggp-fr8h`](https://github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h)
  - Comment: throws when `data` contains `--` anywhere, ends with `-`, or contains characters outside the XML `Char` production
  - ProcessingInstruction: throws when target contains `:` or matches `xml` (case-insensitive), or `data` contains characters outside the XML `Char` production or contains `?>`
  - DocumentType: throws when `publicId` fails `PubidLiteral`, `systemId` fails `SystemLiteral`, or `internalSubset` contains `]>`
- Security: DOM traversal operations (`XMLSerializer.serializeToString()`, `Node.prototype.normalize()`, `Node.prototype.cloneNode(true)`, `Document.prototype.importNode(node, true)`, `node.textContent` getter, `getElementsByTagName()` / `getElementsByTagNameNS()` / `getElementsByClassName()` / `getElementById()`, `Node.prototype.isEqualNode()`) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable `RangeError`. [`GHSA-2v35-w6hq-6mfw`](https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw)
- `isEqualNode` now correctly returns `false` for CDATASection nodes with different `data`

###### Deprecated

- The `splitCDATASections` serializer option is deprecated and will be removed in the next breaking release. The automatic splitting of `"]]>"` in `CDATASection` data was introduced as a workaround; use `requireWellFormed: true` or ensure `CDATASection` data does not contain `"]]>"` before serialization.

###### Chore

- updated dependencies

Thank you,
[@Jvr2022](https://github.com/Jvr2022),
[@praveen-kv](https://github.com/praveen-kv),
[@TharVid](https://github.com/TharVid),
[@decsecre583](https://github.com/decsecre583),
[@tlsbollei](https://github.com/tlsbollei),
[@KarimTantawey](https://github.com/KarimTantawey),
for your contributions

### 0.8.13

- Date: 2026-04-18
- Version: 0.8.13
- Original notes: https://github.com/xmldom/xmldom/releases/tag/0.8.13
- Permalink: https://whatsnew.fyi/product/xmldom/releases/0.8.13

- **security** — XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option that throws InvalidStateError for injection-prone node content when enabled, preventing XML injection via attacker-controlled node data
- **security** — DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative to prevent stack exhaustion on deeply nested DOM trees

[Commits](https://github.com/xmldom/xmldom/compare/0.8.12...0.8.13)

###### Fixed

- Security: `XMLSerializer.serializeToString()` (and `Node.toString()`, `NodeList.toString()`) now accept a `requireWellFormed` option (fourth argument, after `isHtml` and `nodeFilter`). When `{ requireWellFormed: true }` is passed, the serializer throws `InvalidStateError` for injection-prone node content, preventing XML injection via attacker-controlled node data. [`GHSA-j759-j44w-7fr8`](https://github.com/xmldom/xmldom/security/advisories/GHSA-j759-j44w-7fr8) [`GHSA-x6wf-f3px-wcqx`](https://github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx) [`GHSA-f6ww-3ggp-fr8h`](https://github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h)
  - Comment: throws when `data` contains `-->`
  - ProcessingInstruction: throws when `data` contains `?>`
  - DocumentType: throws when `publicId` fails `PubidLiteral`, `systemId` fails `SystemLiteral`, or `internalSubset` contains `]>`
- Security: DOM traversal operations (`XMLSerializer.serializeToString()`, `Node.prototype.normalize()`, `Node.prototype.cloneNode(true)`, `Document.prototype.importNode(node, true)`, `node.textContent` getter, `getElementsByTagName()` / `getElementsByTagNameNS()` / `getElementsByClassName()` / `getElementById()`) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable `RangeError`. [`GHSA-2v35-w6hq-6mfw`](https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw)

Thank you,
[@Jvr2022](https://github.com/Jvr2022),
[@praveen-kv](https://github.com/praveen-kv),
[@TharVid](https://github.com/TharVid),
[@decsecre583](https://github.com/decsecre583),
[@tlsbollei](https://github.com/tlsbollei),
[@KarimTantawey](https://github.com/KarimTantawey),
for your contributions

### 0.9.9

- Date: 2026-03-29
- Version: 0.9.9
- Original notes: https://github.com/xmldom/xmldom/releases/tag/0.9.9
- Permalink: https://whatsnew.fyi/product/xmldom/releases/0.9.9

- **added** — Implement ParentNode.children getter
- **security** — createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec
- **security** — XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods
- **fixed** — Correctly traverse ancestor chain in Node.contains

[Commits](https://github.com/xmldom/xmldom/compare/0.9.8...0.9.9)

###### Added

- implement `ParentNode.children` getter [`#960`](https://github.com/xmldom/xmldom/pull/960) / [`#410`](https://github.com/xmldom/xmldom/issues/410)

###### Fixed

- Security: `createCDATASection` now throws `InvalidCharacterError` when `data` contains `"]]>"`, as required by the [WHATWG DOM spec](https://dom.spec.whatwg.org/#dom-document-createcdatasection). [`GHSA-wh4c-j3r5-mjhp`](https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp)
- Security: `XMLSerializer` now splits CDATASection nodes whose data contains `"]]>"` into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (`appendData`, `replaceData`, `.data =`, `.textContent =`). [`GHSA-wh4c-j3r5-mjhp`](https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp)
- correctly traverse ancestor chain in `Node.contains` [`#931`](https://github.com/xmldom/xmldom/pull/931)

Code that passes a string containing `"]]>"` to `createCDATASection` and relied on the previously unsafe behavior will now receive `InvalidCharacterError`. Use a mutation method such as `appendData` if you intentionally need `"]]>"` in a CDATASection node's data.

###### Chore

- updated dependencies

Thank you,
[@stevenobiajulu](https://github.com/stevenobiajulu),
[@yoshi389111](https://github.com/yoshi389111),
[@thesmartshadow](https://github.com/thesmartshadow),
for your contributions

https://github.com/xmldom/xmldom/discussions/435

### 0.8.12

- Date: 2026-03-29
- Version: 0.8.12
- Original notes: https://github.com/xmldom/xmldom/releases/tag/0.8.12
- Permalink: https://whatsnew.fyi/product/xmldom/releases/0.8.12

- **fixed** — Preserve trailing whitespace in ProcessingInstruction data
- **security** — createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec
- **security** — XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods

[Commits](https://github.com/xmldom/xmldom/compare/0.8.11...0.8.12)

###### Fixed

- preserve trailing whitespace in ProcessingInstruction data [`#962`](https://github.com/xmldom/xmldom/pull/962) / [`#42`](https://github.com/xmldom/xmldom/issues/42)
- Security: `createCDATASection` now throws `InvalidCharacterError` when `data` contains `"]]>"`, as required by the [WHATWG DOM spec](https://dom.spec.whatwg.org/#dom-document-createcdatasection). [`GHSA-wh4c-j3r5-mjhp`](https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp)
- Security: `XMLSerializer` now splits CDATASection nodes whose data contains `"]]>"` into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (`appendData`, `replaceData`, `.data =`, `.textContent =`). [`GHSA-wh4c-j3r5-mjhp`](https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp)

Code that passes a string containing `"]]>"` to `createCDATASection` and relied on the previously unsafe behavior will now receive `InvalidCharacterError`. Use a mutation method such as `appendData` if you intentionally need `"]]>"` in a CDATASection node's data.

Thank you,
[@thesmartshadow](https://github.com/thesmartshadow),
[@stevenobiajulu](https://github.com/stevenobiajulu),
for your contributions

https://github.com/xmldom/xmldom/discussions/357

### 0.8.11

- Date: 2025-08-17
- Version: 0.8.11
- Original notes: https://github.com/xmldom/xmldom/releases/tag/0.8.11
- Permalink: https://whatsnew.fyi/product/xmldom/releases/0.8.11

- **fixed** — update ownerDocument when moving nodes between documents

##### [0.8.11](https://github.com/xmldom/xmldom/compare/0.8.10...0.8.11)

###### Fixed

- update `ownerDocument` when moving nodes between documents [`#933`](https://github.com/xmldom/xmldom/pull/933) / [`#932`](https://github.com/xmldom/xmldom/issues/932)

Thank you, [@shunkica](https://github.com/shunkica), for your contributions

### 0.9.8

- Date: 2025-02-28
- Version: 0.9.8
- Original notes: https://github.com/xmldom/xmldom/releases/tag/0.9.8
- Permalink: https://whatsnew.fyi/product/xmldom/releases/0.9.8

- **fixed** — replace \u2029 as part of normalizeLineEndings
- **changed** — speed up line detection

[Commits](https://github.com/xmldom/xmldom/compare/0.9.8...0.9.7)

###### Fixed

- fix: replace \u2029 as part of normalizeLineEndings [`#839`](https://github.com/xmldom/xmldom/pull/839) / [`#838`](https://github.com/xmldom/xmldom/issues/838)
- perf: speed up line detection [`#847`](https://github.com/xmldom/xmldom/pull/847) / [`#838`](https://github.com/xmldom/xmldom/issues/838)

###### Chore

- updated dependencies
- drop jazzer and rxjs devDependencies [`#845`](https://github.com/xmldom/xmldom/pull/845)

Thank you,
[@kboshold](https://github.com/kboshold),
[@Ponynjaa](https://github.com/Ponynjaa),
for your contributions.


https://github.com/xmldom/xmldom/discussions/435

### 0.9.7

- Date: 2025-01-19
- Version: 0.9.7
- Original notes: https://github.com/xmldom/xmldom/releases/tag/0.9.7
- Permalink: https://whatsnew.fyi/product/xmldom/releases/0.9.7

- **added** — Implementation of hasAttributes
- **fixed** — locator is now true even when other options are being used for the DOMParser
- **fixed** — allow case-insensitive DOCTYPE in HTML
- **changed** — simplify DOM.compareDocumentPosition

[Commits](https://github.com/xmldom/xmldom/compare/0.9.6...0.9.7)

###### Added

- Implementation of `hasAttributes` [`#804`](https://github.com/xmldom/xmldom/pull/804)

###### Fixed

- locator is now true even when other options are being used for the DOMParser [`#802`](https://github.com/xmldom/xmldom/issues/802) / [`#803`](https://github.com/xmldom/xmldom/pull/803)
- allow case-insensitive DOCTYPE in HTML [`#817`](https://github.com/xmldom/xmldom/issues/817) / [`#819`](https://github.com/xmldom/xmldom/pull/819)

###### Performance

- simplify `DOM.compareDocumentPosition` [`#805`](https://github.com/xmldom/xmldom/pull/805)

###### Chore

- updated devDependencies

Thank you,
[@zorkow](https://github.com/zorkow),
[@Ponynjaa](https://github.com/Ponynjaa),
[@WesselKroos](https://github.com/WesselKroos),
for your contributions.


https://github.com/xmldom/xmldom/discussions/435

### 0.9.6

- Date: 2024-12-05
- Version: 0.9.6
- Original notes: https://github.com/xmldom/xmldom/releases/tag/0.9.6
- Permalink: https://whatsnew.fyi/product/xmldom/releases/0.9.6

- **fixed** — Lower error level for unicode replacement character

##### [Commits](https://github.com/xmldom/xmldom/compare/0.9.5...0.9.6)

###### Fixed

- lower error level for unicode replacement character [`#790`](https://github.com/xmldom/xmldom/issues/790) / [`#794`](https://github.com/xmldom/xmldom/pull/794) / [`#797`](https://github.com/xmldom/xmldom/pull/797)

###### Chore

- updated devDependencies
- migrate renovate config [`#792`](https://github.com/xmldom/xmldom/pull/792)

Thank you, [@eglitise](https://github.com/eglitise), for your contributions.