Skip to content
OpenAdvisories
High · 8.7 CVE-2026-73569 EUVD-2026-58184GHSA-8r6m-32jq-jx6q

fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

Published Aug 13, 2026 · Updated Aug 13, 2026 · Assigned by GitHub_M

Description

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.

Affected products

VendorProductAffectedFixed
NaturalIntelligence fast-xml-parser >= 5.9.3, < 5.10.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 node-webfont No fix yet —
Debian 13 node-webfont No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 node-webfont No fix yet —
Ubuntu 26.04 LTS node-webfont No fix yet —
Ubuntu 24.04 LTS node-webfont No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling jitsucom-jitsu-console 2.11.0-r30 —
Wolfi rolling tileserver-gl 5.6.0-r10 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm fast-xml-parser >= 5.9.3, < 5.10.1 5.10.1 GHSA-8r6m-32jq-jx6q

Advisories 1

References