CVE-2026-83615

Name of the Vulnerable Software and Affected Versions @xmldom/xmldom versions prior to 0.8.15 @xmldom/xmldom versions prior to 0.9.12 xmldom versions 0.1.5 through 0.6.0

Description The appendElement function in lib/sax.js uses copy to clone the complete currentNSMap for every nested element that declares a new namespace prefix. This behavior results in quadratic peak namespace-map storage by keeping every ancestor map active on the parse stack. Consequently, a small but highly compressible XML document can exhaust the process heap before the application can perform validation.

Recommendations Update @xmldom/xmldom to version 0.8.15 or later. Update @xmldom/xmldom to version 0.9.12 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability.