{"id":"CVE-2026-73569","revision":"48197c7710e645dcb7fe52e3596db47c","records":[{"revision":"48197c7710e645dcb7fe52e3596db47c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-73569","aliases":[],"title":"fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits","description":"fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.","state":0,"publishedAt":"2026-08-13T17:45:25.045+00:00","modifiedAt":"2026-08-13T18:40:13.283+00:00","affected":[{"ecosystem":"Vendor product","name":"fast-xml-parser","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"NaturalIntelligence\",\n                    \"product\": \"fast-xml-parser\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 5.9.3, < 5.10.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"}],"references":["https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q","https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f","https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-73569","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-73569","identifiers":["CVE-2026-73569"]},"retained":false,"historicalAffected":[]}],"coverage":[]}