Skip to content
Threat Feed
Subscribe

Product

@Xmldom/Xmldom (0.7.0 <= 0.8.14, 0.9.0 <= 0.9.11)

1 brief RSS
medium advisory

Unauthenticated Denial of Service in xmldom via Quadratic Complexity

The xmldom XML parser contains multiple O(n²) complexity flaws in its error-recovery path and DOM normalization logic, allowing an unauthenticated attacker to stall the Node.js event loop using crafted XML payloads.

xmldom +1 denial-of-service vulnerability web-application
1c