xmldom, a pure JavaScript XML library, contains two independent quadratic algorithms that can be triggered by malformed XML inputs. The bug in parseElementStartPart causes repeated rescanning of malformed tag names, while normalize() repeatedly merges adjacent text nodes, each operation growing quadratically with input size. When an attacker supplies a crafted XML document or a programmatically constructed DOM that invokes normalize(), the parser can consume disproportionate CPU and memory resources, leading to a denial of service that may crash or stall the host application. The weakness is made explicit in CWE‑400 for uncontrolled resource consumption, CWE‑407 for quadratic time complexity, and CWE‑1333 for untrusted input handling.

The affected modules are the @xmldom/xmldom package versions prior to 0.8.15 and 0.9.12, and the legacy xmldom package versions 0.3.0 through 0.6.0. Projects that depend on these libraries or import them directly are susceptible. No fixed version exists for the legacy xmldom package; only the @xmldom/xmldom releases from 0.8.15 onward include the remediation.

The vulnerability is scored CVSS 8.7, indicating a significant impact on availability. A direct exploit is achievable by feeding the parser with specially crafted XML or by calling normalize() on a maliciously constructed DOM, requiring only standard input. Because the EPSS score is unavailable, the exact exploitation likelihood is unclear, and the vulnerability is not listed in the CISA KEV catalog. However, the presence of quadratic behaviour in critical parsing routines highlights the need for immediate patching or mitigation to preserve application uptime.