xmldom: Uncontrolled recursion in XML serialization leads to DoS

Description

Seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application.

Reported operations:

• Node.prototype.normalize() — reported by @praveen-kv (email 2026-04-05) and @KarimTantawey (GHSA-fwmp-8wwc-qhv6, via DOMParser.parseFromString())
• `XMLSerializer.

Recommendation

Update the @xmldom/xmldom package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 0.9.0, < 0.9.10

  < 0.8.13**

• Patched version(s): **0.9.10

  0.8.13**

References

• GHSA-2v35-w6hq-6mfw
• CVE-2026-41673
• CWE-674
• CAPEC-310
• OWASP 2021-A6