A high-severity denial of service vulnerability in the xmldom package allows unauthenticated attackers to crash applications by exhausting system resources through malicious XML processing.

The vulnerability stems from inefficient regular expression handling within the processing-instruction production logic, specifically causing quadratic backtracking during DOMParser.parseFromString operations. This flaw allows an unauthenticated attacker to supply a small, malformed XML input that triggers excessive resource consumption, effectively stalling the Node.js event loop.

This vulnerability presents a significant risk to availability, as it allows any unauthenticated actor to perform a denial of service attack against applications relying on the xmldom library. With a CVSS score of 8.7, the potential for service disruption is high, which can lead to significant operational downtime, loss of revenue, and degradation of user trust in affected web services.

Immediate Action: Update the @xmldom/xmldom package to version 0.9.11 or later to implement the necessary security patches.

Proactive Monitoring: Monitor application performance logs for spikes in CPU usage or unexpected event loop latency that may indicate ongoing exploitation attempts.

Compensating Controls: Implement input validation for all incoming XML data to ensure it adheres to strict schemas, and consider utilizing a Web Application Firewall to block suspicious, malformed XML payloads before they reach the application layer.

Public Exploit Available: Unknown

Given the ease with which this vulnerability can be exploited by an unauthenticated attacker, immediate remediation is required. Organizations should prioritize updating the xmldom dependency to version 0.9.11 across all development and production environments to eliminate the risk of service disruption.