The xmldom library is vulnerable to a denial of service attack through improper memory management of namespace maps during XML parsing, which can lead to process heap exhaustion.

This vulnerability, categorized as CWE-770, occurs because the appendElement function clones namespace maps for each nested element. This creates quadratic storage growth that an unauthenticated attacker can trigger by submitting a small, highly compressible XML document.

Successful exploitation of this vulnerability results in a denial of service, as the target process will exhaust its available memory and crash. Given the CVSS score of 8.7, this represents a significant risk to availability, particularly for public-facing services or automated systems that process untrusted XML input. The inability to process legitimate requests may lead to operational downtime and service degradation.

Immediate Action: Organizations using @xmldom/xmldom should update to version 0.8.15 or 0.9.12 immediately. If using the legacy xmldom package, no fix is available, and users are strongly advised to migrate to the @xmldom/xmldom fork to receive security updates.

Proactive Monitoring: Monitor application logs and server metrics for unexpected spikes in memory usage or frequent process restarts associated with XML parsing tasks.

Compensating Controls: Implement strict input validation and size limits on all incoming XML documents to prevent the processing of maliciously crafted, highly compressible payloads.

Public Exploit Available: Unknown

The high CVSS score underscores the severity of this resource exhaustion vulnerability. Administrators must prioritize updating to the patched versions of @xmldom/xmldom. For environments currently relying on the unmaintained xmldom package, migration to the supported fork is the only viable path to remediation and long-term security.