The vulnerability is an uncontrolled recursion in the DOM traversal used by XMLSerializer, which causes the JavaScript engine to throw a RangeError and terminate the process when handling deeply nested XML documents. The flaw is a classic uncontrolled recursion (CWE-674) that can result in denial of service by exhausting the call stack and crashing the application. The consequence is a loss of availability for any service that parses or serializes XML using the affected xmldom library.

The xmldom library for JavaScript is affected. Any project using the npm package xmldom prior to version 0.9.10 or 0.8.13, or version 0.6.0 and earlier, is vulnerable. Updates to 0.9.10, 0.8.13, or later contain the remediation. Projects that integrate xmldom into node, browser, or other JavaScript runtimes and parse or serialize XML are at risk.

The CVSS score of 8.7 indicates high severity, and the EPSS score is not available, so the likelihood of exploitation cannot be quantified precisely. The issue is not listed in KEV, suggesting no confirmed widespread exploitation. The attack vector is likely local, requiring the ability to provide malicious XML to the library; however, if the library is used in a public-facing service, an attacker could supply crafted XML payloads to trigger the stack overflow and cause a denial of service.