The fast-xml-parser library versions 5.9.3 up to but not including 5.10.1 have a vulnerability where multiple DOCTYPE declarations in a single XML document reset entity expansion limits. This allows crafted XML inputs to bypass configured limits on entity expansion, potentially causing excessive CPU usage, event-loop blocking, memory exhaustion, and process termination.