A high-severity algorithmic complexity vulnerability in the xmldom library allows unauthenticated remote attackers to stall the Node.js event loop, resulting in a denial of service.

The library suffers from inefficient algorithmic complexity (CWE-407) in the DOMHandler.startElement and NamedNodeMap.setNamedItem functions, which perform quadratic comparisons when parsing elements with many attributes. This allows an unauthenticated attacker to supply a specially crafted XML document that exhausts CPU resources and stalls the Node.js event loop.

Successful exploitation of this flaw leads to a complete denial of service for applications utilizing the affected xmldom library. Given the CVSS score of 8.7, this represents a significant threat to service availability, as the attack requires no authentication or user interaction to trigger a system stall. This could result in prolonged downtime for critical business services relying on XML processing.

Immediate Action: Update the @xmldom/xmldom package to version 0.8.15 or 0.9.12 immediately. Note that for the legacy xmldom package (version 0.6.0 and earlier), no patch is available, and migration to the @xmldom/xmldom fork is required.

Proactive Monitoring: Monitor server CPU utilization and Node.js event loop latency for unexpected spikes during XML parsing operations. Review application logs for patterns indicating repeated, large, or malformed XML document submissions.

Compensating Controls: Implement strict input validation or size limits on all XML payloads accepted by the application to prevent excessively large or complex documents from reaching the parser. A Web Application Firewall can be configured to block malformed or abnormally large XML structures.

Public Exploit Available: No

Organizations must prioritize the transition from the deprecated xmldom package to the maintained @xmldom/xmldom fork. Once migrated, ensure all instances are updated to the specified safe versions. Given the ease of exploitation and the potential for total service disruption, immediate patching is essential to maintain business continuity.