Skip to content
Log inStart free trial

GHSA-8r6m-32jq-jx6q CVE-2026-73569

fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

High npm
Severity
8.7 / 10
High · CVSS 4.0
Exploit chance (EPSS)
0.51%
Chance of exploitation in the next 30 days. Higher than 43.26% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Fix
5.10.1
Upgrade fast-xml-parser to this version or later

Description

Impact

fast-xml-parser processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to @nodable/entities through addInputEntities().

addInputEntities() resets the entity expansion counters every time it is called. An attacker can therefore insert additional DOCTYPE declarations to repeatedly reset maxTotalExpansions and maxExpandedLength during one parse operation.

This allows a crafted XML document to exceed the configured entity-expansion limits and can cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination.

Workarounds

  • Manually check if multiple DOCTYPEs are not present in input contents
  • Update to v5.10.1
  • Keep processEntity flag off

Affected versions

npm

PackageVulnerableFixed in
fast-xml-parser
>= 5.9.3, < 5.10.1
5.10.1
fast-xml-parser
>= 5.9.3, < 5.10.1
5.10.1

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

fast-xml-parser npm → 5.10.1

npm
npm install fast-xml-parser@5.10.1
yarn
yarn add fast-xml-parser@5.10.1
pnpm
pnpm add fast-xml-parser@5.10.1

Severity breakdown

CVSS 4.0 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
None
User interaction
None
Confidentiality (vulnerable system)
None
Integrity (vulnerable system)
None
Availability (vulnerable system)
High
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None

Weakness

CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

How to prevent it
  • Operation: If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.
  • Implementation: Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.

References

Advisories

Fixes and patches

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-gh4j-gqv2-49f6
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
Medium Also affects fast-xml-parser
GHSA-jp2q-39xq-3w4g
Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser
Medium Also affects fast-xml-parser
GHSA-8gc5-j5rx-235r
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
High Also affects fast-xml-parser
GHSA-fj3w-jwp8-x2g3
fast-xml-parser has stack overflow in XMLBuilder with preserveOrder
Low Also affects fast-xml-parser
GHSA-m7jm-9gc2-mpf2
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
Critical Also affects fast-xml-parser
GHSA-jmr7-xgp7-cmfj
fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
High Also affects fast-xml-parser
GHSA-37qj-frw5-hhjh
fast-xml-parser has RangeError DoS Numeric Entities Bug
High Also affects fast-xml-parser
GHSA-mpg4-rc92-vx8v
fast-xml-parser vulnerable to ReDOS at currency parsing
High Also affects fast-xml-parser

Credits: amitguptagwl, the-vibe-dev

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor