A flaw in the library’s XML parsing routine repeatedly copies a namespace map for each element that introduces a new prefix, creating a quadratic increase in memory usage with each nested element. This unchecked growth can quickly exhaust process heap space and crash the application, resulting in a denial‑of‑service condition. The weakness is a classic example of uncontrolled resource consumption (CWE‑770).

The problem exists in the @xmldom/xmldom package and the older xmldom distribution. For @xmldom/xmldom, any release before 0.8.15 or 0.9.12 is affected; the corresponding older xmldom versions 0.1.5 through 0.6.0 are also vulnerable. The 0.8.15 and 0.9.12 releases include a fix that stops the namespace‑map duplication and should be adopted where possible.

The CVSS score of 8.7 marks the weakness as high severity. An attacker can trigger the issue by supplying a carefully crafted XML payload to any instance of the parser that processes untrusted data. Although EPSS is not available, the absence of any CISA KEV listing does not diminish the need for remediation. The vulnerability is exploitable in any environment that incorporates the affected library, and the attack vector is likely remote via network or local file injection.