The xmldom library is vulnerable to an uncontrolled resource consumption flaw that enables unauthenticated remote attackers to cause a denial of service.

This vulnerability involves two paths of inefficient algorithmic complexity (CWE-407) in lib/sax.js and lib/dom.js, which can be triggered by unauthenticated users to exhaust system resources. The first path is reachable through standard XML parsing, while the second occurs during DOM normalization, both resulting in a significant impact on service availability.

The exploitation of this vulnerability leads to a denial of service, which can cause significant operational disruption by rendering applications using the affected library unresponsive. With a CVSS score of 8.7, this high-severity flaw poses a substantial risk to service reliability and uptime for any environment relying on this XML processing module.

Immediate Action: Users of @xmldom/xmldom must update to version 0.8.15 or 0.9.12 immediately to incorporate the necessary algorithmic fixes. For legacy users of the original xmldom package, no official fix is available, and migration to the maintained @xmldom/xmldom branch is strongly advised.

Proactive Monitoring: Security teams should monitor application logs for spikes in CPU usage or unusually long execution times associated with XML parsing functions.

Compensating Controls: Implement input validation or size limits on incoming XML documents to prevent the processing of excessively complex or malformed structures that could trigger the quadratic reindexing flaw.

Public Exploit Available: Unknown

Given the high severity of this vulnerability and the ease with which it can be triggered over a network, administrators should prioritize updating the @xmldom/xmldom package. Organizations still utilizing the unmaintained xmldom package should treat this as a critical technical debt item and migrate to the current, patched version of @xmldom/xmldom to ensure long-term system stability and protection against resource exhaustion attacks.