{"id":"GHSA-8r6m-32jq-jx6q","summary":"fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits","details":"### Impact\n`fast-xml-parser` processes multiple \"DOCTYPE\" declarations within a single XML document. Each declaration passes its entities to `@nodable/entities` through `addInputEntities()`.\n\n`addInputEntities()` resets the entity expansion counters every time it is called. An attacker can therefore insert additional DOCTYPE declarations to repeatedly reset maxTotalExpansions and maxExpandedLength during one parse operation.\n\nThis allows a crafted XML document to exceed the configured entity-expansion limits and can cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination.\n\n### Workarounds\n- Manually check if multiple DOCTYPEs are not present in input contents\n- Update to v5.10.1\n- Keep `processEntity` flag off","aliases":["CVE-2026-73569"],"modified":"2026-09-10T03:51:11.096045802Z","published":"2026-07-21T22:06:36Z","database_specific":{"github_reviewed_at":"2026-07-21T22:06:36Z","nvd_published_at":null,"cwe_ids":["CWE-776"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q"},{"type":"WEB","url":"https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f"},{"type":"PACKAGE","url":"https://github.com/NaturalIntelligence/fast-xml-parser"},{"type":"WEB","url":"https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1"}],"affected":[{"package":{"name":"fast-xml-parser","ecosystem":"npm","purl":"pkg:npm/fast-xml-parser"},"ranges":[{"type":"SEMVER","events":[{"introduced":"5.9.3"},{"fixed":"5.10.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-8r6m-32jq-jx6q/GHSA-8r6m-32jq-jx6q.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}