AIKIDO-2026-176089

TL;DR

The XML renderer pretty-prints output by emitting indentation whitespace proportional to each element's nesting depth for every opening and closing tag. For a deeply nested document tree the indentation alone sums to a quadratic number of bytes of output and memory. Converting untrusted Markdown to XML, such as a single line of deeply nested blockquotes, can amplify a small request into a very large response and exhaust memory. The fix caps indentation depth with a configurable maximum so output size grows in proportion to input.