CVE-2026-83615

## Summary When an element declares a namespace prefix, xmldom copies the entire in-scope namespace map into a fresh object and keeps that copy on the element while it is open on the parse stack. A crafted document that nests N elements, each declaring one unique prefix, therefore drives the parser to hold on the order of N(N+1)/2 = **O(N²) namespace-map entries at its peak**, so a small, highly compressible input exhausts the heap. Parsing runs under default options on untrusted, network-delivered XML, so a sub-megabyte payload can OOM-crash the process before any application-level validation runs — an unauthenticated denial of service. ## Details `appendElement` performs the copy: `_copy` clones the current namespace map into a fresh object for each prefix-declaring element, and the copy is retained on that element's parse-stack entry: ```js if (localNSMap == null) { localNSMap = Object.create(null); _copy(currentNSMap, (currentNSMap = Object.create(null))); // full copy of all ancestor prefixes } currentNSMap[nsPrefix] = localNSMap[nsPrefix] = value; ... el.currentNSMap = currentNSMap; // retained while the element is open on the parse stack ``` https://github.com/xmldom/xmldom/blob/08a22d78e4bc50f12ce9f5090b8d96ee6031ac7b/lib/sax.js#L467-L540 The copies stack: the element at depth `i` copies a map of size ~`i`, and every ancestor stays live on the parse stack until it closes, so at the deepest point Σ`i` namespace entries are held at once. That peak is transient — the completed DOM retains only O(N), one small namespace map per node — but it is reached during parsing, which is what OOM-crashes the process. ## Proof of Concept A minimal document — N nested elements, each declaring one unique namespace prefix (no SAML wrapper needed): ```js const { DOMParser } = require('@xmldom/xmldom'); function build(n) { let open = '', close = ''; for (let i = 0; i < n; i++) { open += `<a xmlns:p${i}="urn:${i}">`; close = '</a>' + close; } return `<