xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()`

Description

xmldom’s malformed-input error-recovery path has two quadratic-time (O(n²)) behaviors that a single crafted input triggers together, so a tiny, highly compressible document (tens of KB) stalls the Node.js event loop for multiple seconds. It is reachable from DOMParser.parseFromString under default options — i.e.

Recommendation

Update the @xmldom/xmldom package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 0.9.0, <= 0.9.11

  >= 0.7.0, <= 0.8.14**

• Patched version(s): **0.9.12

  0.8.15**

References

• GHSA-93r5-fhx6-vmg9
• CVE-2026-83614
• CWE-400
• CWE-407
• CAPEC-310