github.com
https://github.com/NaturalIntelligence/fast-xml-parser CVE-2026-73569
HIGH
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
Record summary
CVE-2026-73569 has a selected CVSS score of 8.7 (high).
Description
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 13, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
fast-xml-parserBrowse NaturalIntelligence / fast-xml-parser | CVE List | >= 5.9.3, < 5.10.1 | affected |
fast-xml-parserBrowse npm / fast-xml-parser | GitHub Advisory | 5.9.3 to < 5.10.1 · Fixed in 5.10.1 | affected |
References
4github.com
https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f github.com
https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1 github.comConfirmation
https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q