The 'min-document' package prior to version 2.19.1 contains a prototype pollution vulnerability in the removeAttributeNS method. This flaw allows attackers to manipulate the JavaScript prototype chain by exploiting improper handling of the __proto__ property during namespace attribute removal. The vulnerability can lead to denial of service or arbitrary code execution. A fix is available in version 2.19.1.