# xmldom 0.8.14

- Product: xmldom (https://whatsnew.fyi/product/xmldom)
- Vendor: xmldom
- Date: 2026-08-12
- Version: 0.8.14
- Original notes: https://github.com/xmldom/xmldom/releases/tag/0.8.14
- Permalink: https://whatsnew.fyi/product/xmldom/releases/0.8.14

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — XMLSerializer.serializeToString() now rejects invalid element and attribute names when requireWellFormed: true is passed, throwing InvalidStateError for names that are not valid XML QNames, preventing XML injection via createElement() and setAttribute()

[Commits](https://github.com/xmldom/xmldom/compare/0.8.13...0.8.14)

###### Fixed

- Security: `XMLSerializer.serializeToString()` now also rejects invalid element and attribute names when `{ requireWellFormed: true }` is passed, throwing `InvalidStateError` for a name that is not a valid XML [`QName`](https://www.w3.org/TR/xml-names/#NT-QName) (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized `xmlns:` declaration). This prevents XML injection via `createElement()` / `setAttribute()`, extending the existing `requireWellFormed` checks to the serialized name set. [`GHSA-w2rr-34g9-rvrj`](https://github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrj) [`GHSA-4w3w-2rp5-g8jm`](https://github.com/xmldom/xmldom/security/advisories/GHSA-4w3w-2rp5-g8jm)

Thank you,
[@bhaswanthc](https://github.com/bhaswanthc),
[@jmestwa-coder](https://github.com/jmestwa-coder),
for your contributions