CVE-2026-73569: CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') in NaturalIntelligence fast-xml-parser
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.
AI Analysis
Technical Summary
fast-xml-parser versions 5.9.3 to 5.10.0 contain a CWE-776 vulnerability due to improper restriction of recursive entity references in DTDs. The parser processes multiple DOCTYPE declarations and resets entity expansion limits each time, allowing crafted XML to repeatedly reset these limits during a single parse. This leads to excessive resource consumption and potential denial of service. The vulnerability is resolved in version 5.10.1.
Potential Impact
An attacker can craft XML documents that cause the parser to consume excessive CPU and memory resources, leading to event-loop blocking and potential process termination, resulting in denial of service.
Mitigation Recommendations
Upgrade fast-xml-parser to version 5.10.1 or later, where this vulnerability is fixed. No other mitigations are specified.
CVE-2026-73569: CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') in NaturalIntelligence fast-xml-parser
Description
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.
CVSS v4.0
Score 8.7high
Affected software
NaturalIntelligence
fast-xml-parser
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
fast-xml-parser versions 5.9.3 to 5.10.0 contain a CWE-776 vulnerability due to improper restriction of recursive entity references in DTDs. The parser processes multiple DOCTYPE declarations and resets entity expansion limits each time, allowing crafted XML to repeatedly reset these limits during a single parse. This leads to excessive resource consumption and potential denial of service. The vulnerability is resolved in version 5.10.1.
Potential Impact
An attacker can craft XML documents that cause the parser to consume excessive CPU and memory resources, leading to event-loop blocking and potential process termination, resulting in denial of service.
Mitigation Recommendations
Upgrade fast-xml-parser to version 5.10.1 or later, where this vulnerability is fixed. No other mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-12T20:53:46.381Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a7e08efbf8831d5399b7997
Added to database: 08/13/2026, 18:11:59 UTC
Last enriched: 08/13/2026, 20:29:02 UTC
Last updated: 09/28/2026, 13:47:47 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.