A high-severity denial of service vulnerability in the xmldom library permits unauthenticated remote attackers to exhaust system resources and crash applications by stalling the Node.js event loop.

This vulnerability is caused by inefficient regular expression complexity (CWE-1333) within the lib/sax.js file, which triggers uncontrolled resource consumption (CWE-400). Unauthenticated attackers can exploit this by submitting a small, malicious XML input that forces the parser into quadratic backtracking, effectively locking the Node.js event loop.

The exploitation of this vulnerability results in a complete denial of service for any application relying on the affected xmldom parser. Given the CVSS score of 8.7, the impact on service availability is significant, potentially causing widespread system downtime and operational disruption. Because the vulnerability requires no authentication and is easily triggered by small inputs, the risk to public-facing services processing XML data is critical.

Immediate Action: Update the @xmldom/xmldom dependency to version 0.8.15 or later to incorporate the corrected regular expression logic.

Proactive Monitoring: Monitor server CPU usage and Node.js event loop lag for sudden spikes that correlate with incoming XML parsing requests.

Compensating Controls: Implement strict input validation or size limits on incoming XML payloads at the Web Application Firewall (WAF) or API gateway layer to block malformed or excessively complex tags.

Public Exploit Available: Unknown

Organizations using the xmldom library must prioritize updating to version 0.8.15 immediately. Due to the ease of triggering this denial of service, failure to patch may leave systems vulnerable to simple, low-bandwidth attacks that can render critical services non-functional. Verify your dependency tree to identify and remediate all instances of the affected versions across your environment.