# xmldom 0.9.12

- Product: xmldom (https://whatsnew.fyi/product/xmldom)
- Vendor: xmldom
- Date: 2026-08-21
- Version: 0.9.12
- Original notes: https://github.com/xmldom/xmldom/releases/tag/0.9.12
- Permalink: https://whatsnew.fyi/product/xmldom/releases/0.9.12

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory by inheriting the in-scope namespace map through the prototype chain instead of copying it for every prefix-declaring element, preventing denial-of-service from DOMParser.parseFromString
- **security** — Attribute de-duplication during parsing is now O(M) instead of O(M²) using a null-prototype membership index, preventing denial-of-service from a well-formed document with a hostile number of duplicate attributes
- **security** — HTML raw-text parsing now matches closing tags case-insensitively and handles missing closing tags explicitly, preventing denial-of-service from output amplification
- **security** — Malformed-input recovery is now linear instead of quadratic, with malformed tag-name scan terminating at an embedded < and Node.prototype.normalize() merging adjacent text nodes in O(K) instead of O(K²)
- **security** — XMLSerializer.serializeToString() under { requireWellFormed: true } now rejects a DocType name that is not a valid XML Name, throwing InvalidStateError to prevent XML injection
- **security** — XMLSerializer.serializeToString() under { requireWellFormed: true } now validates a processing-instruction target as an XML NCName and rejects case-insensitive xml, throwing InvalidStateError to prevent PI-target injection
- **security** — Document.createEntityReference() now rejects an invalid XML Name at creation, and XMLSerializer.serializeToString() under { requireWellFormed: true } validates an EntityReference nodeName as an XML Name, throwing InvalidStateError to prevent XML injection
- **security** — The requireWellFormed serializer's element- and attribute-name validators no longer treat an interior line terminator as satisfying the name anchors, rejecting such names with InvalidStateError
- **security** — The requireWellFormed serializer's DocType publicId/systemId validators no longer treat an interior line terminator as satisfying the anchor, rejecting identifiers with ECMAScript line terminators with InvalidStateError
- **security** — createElementNS(), createAttributeNS(), createDocumentType(), and createAttribute() now reject names containing line terminators with InvalidCharacterError
- **security** — The parser now reports a not-well-formed end tag with trailing content as an error instead of accepting it silently, per the XML ETag production
- **fixed** — DOMExceptions raised during parsing are now reported as a fatalError with the originating error preserved as the cause on the resulting ParseError

[Commits](https://github.com/xmldom/xmldom/compare/0.9.11...0.9.12)

###### Fixed

- Security: parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory; the in-scope namespace map is inherited through the prototype chain instead of being copied for every prefix-declaring element (O(N) instead of O(N²)), preventing a denial-of-service reachable from `DOMParser.parseFromString` with default options. Serialized output is byte-identical. [`GHSA-965w-775f-mr7g`](https://github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g)
- Security: attribute de-duplication during parsing is now O(M) instead of O(M²); the `NamedNodeMap` parse-time dedup path uses a null-prototype membership index, so a well-formed document with a hostile number of duplicate attributes can no longer wedge the parse. Attribute order and duplicate resolution (last value wins, first position kept) are byte-identical, preserving the XML [no-duplicate-attributes well-formedness constraint](https://www.w3.org/TR/xml/#uniqattspec). [`GHSA-8344-3jmq-59r6`](https://github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6)
- Security: HTML raw-text parsing no longer amplifies output on a missing or case-mismatched closing tag; the closing tag is matched case-insensitively per the WHATWG HTML [RAWTEXT end-tag rule](https://html.spec.whatwg.org/multipage/parsing.html#rawtext-end-tag-name-state) and a missing closing tag is handled explicitly, preventing a denial-of-service. Output for well-formed input is unchanged. [`GHSA-6mj3-qw4j-hgrw`](https://github.com/xmldom/xmldom/security/advisories/GHSA-6mj3-qw4j-hgrw)
- Security: malformed-input recovery is now linear instead of quadratic — the malformed tag-name scan terminates at an embedded `<`, and `Node.prototype.normalize()` merges adjacent text nodes in O(K) instead of O(K²) (also reachable programmatically), per [`normalize()`](https://dom.spec.whatwg.org/#dom-node-normalize) in the WHATWG DOM spec. DOM output is unchanged; only the reported error text differs. [`GHSA-93r5-fhx6-vmg9`](https://github.com/xmldom/xmldom/security/advisories/GHSA-93r5-fhx6-vmg9)
- Security: `XMLSerializer.serializeToString()` under `{ requireWellFormed: true }` now rejects a DocType `name` that is not a valid XML [`Name`](https://www.w3.org/TR/xml/#NT-Name), throwing `InvalidStateError` — matching the sibling `publicId`/`systemId`/`internalSubset` checks and preventing XML injection via `DocumentType.name`. [`GHSA-27p8-2357-5qqv`](https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv)
- Security: `XMLSerializer.serializeToString()` under `{ requireWellFormed: true }` now validates a processing-instruction target as an XML [`NCName`](https://www.w3.org/TR/xml-names/#NT-NCName) and rejects a case-insensitive `xml`, throwing `InvalidStateError` — preventing PI-target injection via `>`, `?`, or whitespace. [`GHSA-c7q8-3ch8-vqpv`](https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv)
- Security: `Document.createEntityReference()` now rejects an invalid XML [`Name`](https://www.w3.org/TR/xml/#NT-Name) at creation, and `XMLSerializer.serializeToString()` under `{ requireWellFormed: true }` validates an `EntityReference` `nodeName` as an XML `Name`, throwing `InvalidStateError` — preventing XML injection via an entity-reference name. [`GHSA-6gmq-8vp8-gcm6`](https://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6)
- Security: the `requireWellFormed` serializer's element- and attribute-name validators no longer treat an interior line terminator as satisfying the name anchors, so a name containing a line terminator is rejected with `InvalidStateError` — closing a bypass of the XML [`QName`](https://www.w3.org/TR/xml-names/#NT-QName) check. [`GHSA-jxjr-3g7g-3944`](https://github.com/xmldom/xmldom/security/advisories/GHSA-jxjr-3g7g-3944)
- Security: the `requireWellFormed` serializer's DocType `publicId`/`systemId` validators no longer treat

_[Truncated at 4000 characters — full notes: https://github.com/xmldom/xmldom/releases/tag/0.9.12]_