CyberRota Analysis
AI-GeneratedThe vulnerability affects the xmldom module in JavaScript, specifically versions 0.7.0 to 0.8.15, where a flaw in the end-tag parsing can lead to a denial-of-service condition by stalling the Node.js event loop when processing certain XML inputs. This high-severity issue should be prioritized by developers and organizations using affected versions of xmldom to ensure the stability and security of their applications. Users are advised to upgrade to version 0.8.15 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression /[ \t\n\r]+$/g. For an end tag containing a long whitespace run followed by a non-whitespace character, the expression retries from each possible starting position and backtracks quadratically before failing its end anchor. DOMParser.parseFromString() reaches the path under default options, allowing a small unauthenticated XML input to stall the Node.js event loop; the 0.9.x and unscoped npm lines do not contain this expression. This issue is fixed in @xmldom/xmldom version 0.8.15.