Node xmldom: Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.1.5 through 0.6.0, appendElement in lib/sax.js uses _copy to clone the… (CVE-2026-83615)

The vulnerability in node-xmldom arises from the appendElement function in lib/sax.js, which clones the entire currentNSMap for each nested element with a new namespace prefix. This behavior causes quadratic peak namespace-map storage growth, leading to excessive memory consumption and potential process heap exhaustion. This can occur even with small XML documents that are highly compressible, resulting in denial of service. The flaw affects @xmldom/xmldom versions prior to 0.8.15 and 0.9.12, and xmldom versions 0.1.5 through 0.6.0. The issue is resolved in @xmldom/xmldom 0.8.15 and 0.9.12, but no fix exists for xmldom. The vulnerability has a CVSS 4.0 vector indicating network attack vector, low complexity, no privileges or user interaction required, and high impact on availability.

An attacker can cause denial of service by sending crafted XML documents that trigger excessive memory consumption due to quadratic namespace-map storage growth during parsing. This can exhaust the process heap and crash or hang the application using the vulnerable xmldom versions. There is no indication of code execution or data disclosure. The impact is limited to availability degradation.

Upgrade to @xmldom/xmldom versions 0.8.15 or 0.9.12 where this issue is fixed. For xmldom versions 0.1.5 through 0.6.0, no fixed version is available, so consider alternative XML parsing libraries or implement input validation and size limits to mitigate potential denial of service. Monitor vendor advisories for any updates regarding xmldom remediation.