xmldom is a pure‑JavaScript XML parser that can also parse HTML. From versions 0.9.0‑beta.1 through 0.9.12 the HTML‑mode parsing path mishandles mixed‑case closing tags for raw‑text elements such as script, style, textarea or title. The parser uses a case‑sensitive indexOf followed by a substring call with a negative offset, which causes the parsing loop to stall and its output to grow quadratically. As a result a small untrusted HTML document can trigger disproportionate CPU usage and memory consumption when parsed or serialized, leading to a denial of service.

Any environment that incorporates @xmldom/xmldom between versions 0.9.0‑beta.1 and 0.9.12 and calls DOMParser.parseFromString() in HTML mode is affected. This includes Node.js applications, browser environments, or any JavaScript runtime that uses the library. Version 0.9.12 and later contain the fix.

The vulnerability has a CVSS score of 8.7, indicating high severity. EPSS is not available and the issue is not listed in CISA KEV, suggesting no widespread exploitation as of now. Based on the description, it is inferred that an attacker can supply malformed HTML containing a mis‑cased closing tag for a raw‑text element to an application that uses xmldom to parse untrusted input. If the application accepts such input, the attacker can remotely or locally trigger excessive CPU and memory usage, resulting in service disruption. The flaw is easy to exploit once the input path is exposed, making the risk significant in susceptible environments.