# xmldom 0.8.13

- Product: xmldom (https://whatsnew.fyi/product/xmldom)
- Vendor: xmldom
- Date: 2026-04-18
- Version: 0.8.13
- Original notes: https://github.com/xmldom/xmldom/releases/tag/0.8.13
- Permalink: https://whatsnew.fyi/product/xmldom/releases/0.8.13

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option that throws InvalidStateError for injection-prone node content when enabled, preventing XML injection via attacker-controlled node data
- **security** — DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative to prevent stack exhaustion on deeply nested DOM trees

[Commits](https://github.com/xmldom/xmldom/compare/0.8.12...0.8.13)

###### Fixed

- Security: `XMLSerializer.serializeToString()` (and `Node.toString()`, `NodeList.toString()`) now accept a `requireWellFormed` option (fourth argument, after `isHtml` and `nodeFilter`). When `{ requireWellFormed: true }` is passed, the serializer throws `InvalidStateError` for injection-prone node content, preventing XML injection via attacker-controlled node data. [`GHSA-j759-j44w-7fr8`](https://github.com/xmldom/xmldom/security/advisories/GHSA-j759-j44w-7fr8) [`GHSA-x6wf-f3px-wcqx`](https://github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx) [`GHSA-f6ww-3ggp-fr8h`](https://github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h)
  - Comment: throws when `data` contains `-->`
  - ProcessingInstruction: throws when `data` contains `?>`
  - DocumentType: throws when `publicId` fails `PubidLiteral`, `systemId` fails `SystemLiteral`, or `internalSubset` contains `]>`
- Security: DOM traversal operations (`XMLSerializer.serializeToString()`, `Node.prototype.normalize()`, `Node.prototype.cloneNode(true)`, `Document.prototype.importNode(node, true)`, `node.textContent` getter, `getElementsByTagName()` / `getElementsByTagNameNS()` / `getElementsByClassName()` / `getElementById()`) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable `RangeError`. [`GHSA-2v35-w6hq-6mfw`](https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw)

Thank you,
[@Jvr2022](https://github.com/Jvr2022),
[@praveen-kv](https://github.com/praveen-kv),
[@TharVid](https://github.com/TharVid),
[@decsecre583](https://github.com/decsecre583),
[@tlsbollei](https://github.com/tlsbollei),
[@KarimTantawey](https://github.com/KarimTantawey),
for your contributions