CVE-2026-83615

xmldom's SAX event handler (appendElement in lib/sax.js) clones the entire current namespace map for every nested element that declares a new namespace prefix, keeping every ancestor's map alive on the parse stack and producing quadratic peak memory usage during parsing (CWE-770). A remote, unauthenticated attacker can trigger this by supplying a small but deeply nested XML document with many namespace-prefix declarations to any application that parses it with a vulnerable version of the library, exhausting the process heap before application-level validation can run. The impact is denial of service only, reflected in the CVSS 4.0 score of 8.7 (High) with high availability impact and no confidentiality or integrity impact. Any JavaScript application or service bundling @xmldom/xmldom prior to 0.8.15 or 0.9.12, or the legacy xmldom package versions 0.1.5 through 0.6.0 (which has no fixed release), and that parses untrusted XML is affected; exploitation has not been observed (EPSS 0.4%, not in CISA KEV, no public PoC).

What to do: Upgrade to @xmldom/xmldom 0.8.15 or 0.9.12 (matching your current release line) and, if you use the legacy xmldom package (0.1.5-0.6.0), migrate to the maintained @xmldom/xmldom package since no fixed version exists for it. Until patched, bound XML input size and nesting/namespace-declaration depth for untrusted XML and monitor services for memory-exhaustion crashes. Audit your dependency tree and lockfiles (e.g. npm ls xmldom @xmldom/xmldom) for transitive exposure.