The vulnerability arises because HTMLInputElement.checkValidity() uses the user-supplied pattern property to create a RegExp object without any validation or safeguards. Attackers can supply regex patterns with nested quantifiers that cause catastrophic backtracking, freezing the event loop and resulting in denial of service. The fix, committed on the main branch, introduces a maximum pattern length of 1024 characters and detects nested quantifiers to reject unsafe patterns, treating them as non-matching to prevent ReDoS.

An attacker can cause the application to freeze or become unresponsive by supplying malicious regex patterns that trigger catastrophic backtracking during input validation. This results in denial of service affecting availability. There is no indication of privilege escalation, data disclosure, or code execution from this vulnerability.

A fix is available in versions 0.0.22 and later of @asymmetric-effort/nogginlessdom. The fix includes limiting the pattern length and rejecting patterns with nested quantifiers before regex construction. Users should upgrade to version 0.0.22 or later to mitigate this vulnerability.