fast-xml-parser processes multiple DOCTYPE declarations within one XML document, passing each declaration's entities to @nodable/entities via addInputEntities(). The addInputEntities() function resets entity expansion counters each time it is called, enabling an attacker to repeatedly reset maxTotalExpansions and maxExpandedLength during a single parse operation. This flaw permits crafted XML documents to exceed entity-expansion limits, leading to resource exhaustion and denial of service conditions. The vulnerability affects versions >=5.9.3 and <5.10.1 of fast-xml-parser.

An attacker can craft XML documents with multiple DOCTYPE declarations to bypass entity expansion limits, causing excessive CPU consumption, blocking the event loop, exhausting memory, and potentially terminating the process. This results in denial of service against applications using affected versions of fast-xml-parser.

A fix is available in fast-xml-parser version 5.10.1. Users should update to version 5.10.1 or later. Alternatively, manually ensure input XML does not contain multiple DOCTYPE declarations or keep the processEntity flag disabled to mitigate the issue.