xmldom CVE-2026-83615

No special server configuration is required - the vulnerability is triggered by the default behavior of DOMParser.parseFromString in any xmldom version within the affected range. The sole prerequisite is that attacker-supplied data reaches a parseFromString call without a prior hard limit on document size or namespace depth. Exploitation is constrained by: the affected package must be installed and reachable in the code path handling attacker input; users of @xmldom/xmldom >= 0.8.15 or >= 0.9.12 are fully protected by the prototype-chain fix; and applications enforcing a strict incoming byte limit (e.g., <= 64 KB) significantly raise the attack cost, though they do not fully eliminate the risk given XML namespace compressibility.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VA:H accurately reflects the threat model: any network-reachable endpoint that parses attacker-controlled XML with xmldom is exploitable without credentials or user interaction. No EPSS score is present in the provided data, so relative exploitation probability cannot be quantified numerically. No CISA KEV listing and no explicit POC code are noted, so exploitation is not confirmed to be active - however, the attack primitive is mechanically trivial (craft an XML document with many namespace-declaring elements and POST it). Applications processing untrusted XML - SOAP services, RSS/Atom feed consumers, SVG handlers, XML-based APIs - represent the primary exposure surface. The legacy xmldom package (0.1.5-0.6.0) carries permanent residual risk because no fix will be published; environments unable to migrate face an unresolvable gap. The high availability-only impact (no confidentiality or integrity exposure) is consistent with a pure resource-exhaustion class flaw.

An attacker sends a POST request to a SOAP or XML API endpoint with a body containing a compact XML document with hundreds of deeply nested elements each declaring a new namespace prefix. The xmldom SAX parser, allocating a full copy of the ancestor namespace map at each nesting level, consumes O(N²) heap memory and exhausts the Node.js process heap, crashing or hanging the server. The payload can be kept small by reusing short namespace URIs, making the attack efficient to repeat across multiple application instances.