CVE-2026-73569: CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') in NaturalIntelligence fast-xml-parser
A vulnerability in NaturalIntelligence fast-xml-parser versions 5.9.3 through 5.10.0 allows crafted XML documents with multiple DOCTYPE declarations to bypass entity expansion limits. This can cause excessive CPU usage, event-loop blocking, memory exhaustion, and process termination. The issue is fixed in version 5.10.1.
AI Analysis
Technical Summary
fast-xml-parser versions 5.9.3 to 5.10.0 contain a CWE-776 vulnerability due to improper restriction of recursive entity references in DTDs. The parser processes multiple DOCTYPE declarations and resets entity expansion limits each time, allowing crafted XML to repeatedly reset these limits during a single parse. This leads to excessive resource consumption and potential denial of service. The vulnerability is resolved in version 5.10.1.
Potential Impact
An attacker can craft XML documents that cause the parser to consume excessive CPU and memory resources, leading to event-loop blocking and potential process termination, resulting in denial of service.
Mitigation Recommendations
Upgrade fast-xml-parser to version 5.10.1 or later, where this vulnerability is fixed. No other mitigations are specified.
CVE-2026-73569: CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') in NaturalIntelligence fast-xml-parser
Description
A vulnerability in NaturalIntelligence fast-xml-parser versions 5.9.3 through 5.10.0 allows crafted XML documents with multiple DOCTYPE declarations to bypass entity expansion limits. This can cause excessive CPU usage, event-loop blocking, memory exhaustion, and process termination. The issue is fixed in version 5.10.1.
CVSS v4.0
Score 8.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
fast-xml-parser versions 5.9.3 to 5.10.0 contain a CWE-776 vulnerability due to improper restriction of recursive entity references in DTDs. The parser processes multiple DOCTYPE declarations and resets entity expansion limits each time, allowing crafted XML to repeatedly reset these limits during a single parse. This leads to excessive resource consumption and potential denial of service. The vulnerability is resolved in version 5.10.1.
Potential Impact
An attacker can craft XML documents that cause the parser to consume excessive CPU and memory resources, leading to event-loop blocking and potential process termination, resulting in denial of service.
Mitigation Recommendations
Upgrade fast-xml-parser to version 5.10.1 or later, where this vulnerability is fixed. No other mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-12T20:53:46.381Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7e08efbf8831d5399b7997
Added to database: 08/13/2026, 18:11:59 UTC
Last enriched: 08/13/2026, 20:29:02 UTC
Last updated: 08/14/2026, 00:08:49 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.