Seven recursive traversals in `lib/dom.js` operate without a depth limit. When processing a sufficiently deeply nested DOM tree, the JavaScript call stack is exhausted, resulting in a `RangeError: Maximum call stack size exceeded` and crashing the application. This can lead to a denial of service if a service accepts attacker-controlled XML and performs any of the affected operations.
The affected functions and entry points include
- `Node.prototype.normalize()`
- `XMLSerializer.serializeToString()`
- `Element.getElementsByTagName()`, `getElementsByTagNameNS()`, `getElementsByClassName()`, and `getElementById()` (via the ` visitNode` function)
- `Node.cloneNode(true)`
- `Document.importNode(node, true)`
- `node.textContent` (getter)
- `Node.isEqualNode(other)`