{"id":"CVE-2026-73569","summary":"fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits","details":"fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.","aliases":["GHSA-8r6m-32jq-jx6q"],"modified":"2026-08-15T11:47:52.721291265Z","published":"2026-08-13T17:45:25.045Z","related":["CGA-phjr-h27v-3h8h"],"database_specific":{"cwe_ids":["CWE-776"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73569.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73569.json"},{"type":"ADVISORY","url":"https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73569"},{"type":"FIX","url":"https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/naturalintelligence/fast-xml-parser","events":[{"introduced":"93a09f108d6f457a84e607a6806a7bfd6abc3e55"},{"fixed":"4e546e03987662de5495d050b5fba26bea65383f"},{"fixed":"2ce7191ef0f96473b8c7e0c384fbc4ad34a222de"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"5.9.3"},{"fixed":"5.10.1"}]}}],"versions":["v5.10.0","v5.9.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73569.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}