The xmldom library contains a high-severity vulnerability that allows unauthenticated attackers to trigger excessive CPU and memory consumption, leading to a denial of service.

This flaw, categorized under CWE-400 and CWE-178, occurs because the parser mishandles mixed-case closing tags for specific raw-text elements. An unauthenticated attacker can exploit this by providing a specially crafted text/html document to the DOMParser, forcing the application into an unstable parsing state.

The vulnerability poses a significant risk to application availability. By exploiting this flaw, an attacker can exhaust server resources, effectively taking the service offline and causing system downtime. With a CVSS score of 8.7, this issue is classified as high severity, reflecting the ease of exploitation and the potential for a complete service disruption.

Immediate Action: Update the xmldom dependency to version 0.9.12 or later immediately to incorporate the necessary fix for the parsing logic.

Proactive Monitoring: Monitor server CPU and memory utilization metrics for sudden, unexplained spikes that correlate with incoming request patterns.

Compensating Controls: Implement input validation to restrict the size and complexity of XML/HTML content processed by the application, and deploy a Web Application Firewall to filter potentially malicious payloads.

Public Exploit Available: No

Given the high CVSS score and the potential for denial of service, administrators must prioritize updating the xmldom package. Because this vulnerability is easily triggered without authentication, delaying the patch leaves systems exposed to trivial resource exhaustion attacks. Apply the update to version 0.9.12 across all production environments to ensure stability and resilience.