xmldom: Quadratic-time attribute deduplication

Description

xmldom builds the attribute collection of every parsed element by inserting attributes one at a time into a DOM NamedNodeMap. Each insertion first performs a linear scan of all already-inserted attributes to enforce the DOM uniqueness rule (no two attributes with the same qualified name / namespace+local-name).

Recommendation

Update the @xmldom/xmldom package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 0.9.0, <= 0.9.11

  >= 0.7.0, <= 0.8.14**

• Patched version(s): **0.9.12

  0.8.15**

References

• GHSA-8344-3jmq-59r6
• CVE-2026-83613
• CWE-407
• CAPEC-310