The vulnerability is a Regular Expression Denial of Service flaw in the xmldom library, caused by an unanchored global regular expression that for an end tag containing a long sequence of whitespace followed by a non‑whitespace character retries from every position and backtracks quadratically. When DOMParser.parseFromString processes such input, the expression ultimately fails but has already exhausted the Node.js event loop, causing a stall. The result is a denial of service by halting application activity. The flaw is limited to a loss of availability; no confidentiality or integrity effects are described in the CVE statement.

Packages of the xmldom npm library in the release‑0.8.x branch from version 0.7.0 through 0.8.14 inclusive are affected. Projects that depend on @xmldom/xmldom at any of these versions and invoke DOMParser.parseFromString with untrusted XML input are vulnerable. The 0.9.x series and the unscoped npm releases exclude the vulnerable regular expression and are not susceptible.

The CVSS base score of 8.7 reflects a high severity availability impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the unauthenticated delivery of a malformed XML document to a process that uses the library’s DOMParser.parseFromString under default options; the attacker can then trigger the event‑loop stall by providing a crafted XML file that satisfies the problematic pattern. This stall can be exploited wherever the library is used to process external XML data.