A defect in the xmldom XML parser causes quadratic-time attribute deduplication. While parsing elements with many distinct attributes, each attribute insertion triggers a linear lookup, causing the number of comparisons to grow quadratically with the attribute count. The resulting CPU‑intensive operation can stall the Node.js event loop, preventing the application from handling legitimate requests and causing a denial of service. This weakness is classified as CWE‑407 for inefficient algorithm design and as CWE‑606 for improper input validation, as the parser fails to reject large or malformed XML data.

The vulnerability affects the @xmldom/xmldom package versions older than 0.8.15 and 0.9.12, as well as the legacy xmldom package version 0.6.0 and earlier. Any Node.js application that imports these libraries for XML parsing is directly impacted, while newer versions have the fix applied. There is no fixed release for the older xmldom project, so the risk persists for environments that continue to use it.

The CVSS score of 8.7 indicates a high severity impact on availability. The likely attack vector is the delivery of a crafted XML document containing many attributes to an application that parses untrusted XML input. Based on the description, it is inferred that exploitation requires only this delivery and does not need authentication or privileged access. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited confirmed exploitation to date. Nonetheless, the risk is high for any deployment that processes XML from external input without additional controls.