The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw in the XML parsing logic of xmldom. A gor­ey S+ separator and lazy Char*? pattern can lead to quadratic back‑tracking when the closing ">" of a processing instruction is missing. The resulting CPU exhaustion stalls the Node.js event loop, disrupting service availability but not compromising confidentiality or integrity. Because the flaw is triggered by XML input, an attacker could cause prolonged resource consumption by sending a crafted document to any module that uses DOMParser.parseFromString without authentication.

The issue affects the xmldom library for the ranges 0.9.0-beta.9 through 0.9.11 inclusive. The vendor package is @xmldom/xmldom, version 0.9.11, which contains the fix.

With a CVSS score of 8.7 the flaw is high‑severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Given that the trigger is any XML string fed to the parser, the likely attack vector is the injection of a malicious XML payload that is parsed locally, leading to a denial of service via event‑loop blockage. The risk is elevated for applications that process untrusted XML from external sources.