Executive brief
xmldom is a JavaScript library that parses XML documents into the DOM (Document Object Model). When processing XML with deeply nested namespace declarations, the parser accumulates redundant copies of namespace maps in memory, consuming quadratic (O(N²)) heap space during parsing. An attacker can send a crafted sub-megabyte XML document that causes the parser to exhaust available memory and crash the application before any validation occurs, resulting in a complete denial of service with a trivial, highly compressible payload.
Technical details
The vulnerability is a resource exhaustion flaw (CWE-770) in the `appendElement` function within xmldom's SAX parser. When an XML element declares a namespace prefix, the parser invokes `_copy` to clone the current namespace map into a fresh object for each prefix-declaring element, retaining this copy on the element's parse-stack entry. Because every ancestor element remains live on the parse stack until closing, deeply nested documents with unique namespace prefixes at each level cause the parser to hold Σi namespace entries (summing to O(N²) at peak). The attack requires no authentication, privileges, or user interaction; a single network-delivered XML request of trivial complexity drives multi-gigabyte peak memory consumption and OOM-crashes the process before application-level validation (e.g., SAML signature verification, schema checks) can execute. The payload is highly compressible, making it effective over compressed HTTP transports. Patches are available: version 0.8.15 and 0.9.12 fix the issue by using prototype-chain inheritance instead of object copying, reducing peak memory to O(N) while preserving byte-identical serialized output.
Affected products
- xmldom @xmldom/xmldom 0.7.0 through 0.8.14, 0.9.0 through 0.9.11
- xmldom xmldom 0.1.5 through 0.6.0
Timeline
- 2026-09-08: disclosed: Published to GitHub Advisory Database
- 2026-09-08: patched: Patched versions 0.8.15 and 0.9.12 released