CVE-2022-21144: Denial of Service Vulnerability in libxmljs
Summary
CVE-2022-21144: Denial of service vulnerability exists in libxmljs. Affects libxmljs versions < 0.19.8. Fixed in 0.19.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxmljs is a package that provides libxml bindings for the v8 JavaScript engine. It allows developers to parse and manipulate XML documents using JavaScript. The vulnerability affects all versions of the libxmljs package.
Vulnerability Detail
The vulnerability in libxmljs arises when the libxmljs.parseXml function is invoked with a non-buffer argument. In such cases, the V8 code attempts to invoke the .toString method of the argument. However, if the toString value is not a Function object, V8 crashes. This can lead to a denial of service (DoS) attack, causing the application to become unresponsive or crash.
How To Fix
Latest published version: 1.0.11 as of 22 Oct 2026
npm install libxmljs@1.0.11Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.19.8
This is the first release that contains the fix.
npm install libxmljs@0.19.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The libxmljs package is vulnerable to a denial of service (DoS) attack due to a flaw in the parseXml function. Developers should update to version 0.19.8 or later to fix this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for libxmljs →
FAQ
libxmljs is a package that provides libxml bindings for the v8 JavaScript engine. It allows developers to parse and manipulate XML documents using JavaScript.
The vulnerability can lead to a denial of service (DoS) attack, causing the application to become unresponsive or crash.
All versions of the libxmljs package are affected by this vulnerability.
To fix this vulnerability, developers should update the libxmljs package to version 0.19.8 or later.
There is no specific workaround mentioned for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxmljs.
