{"id":"GHSA-8r6m-32jq-jx6q","revision":"e7b252ec65dd4a08a41973a131f7a2fb","records":[{"revision":"e7b252ec65dd4a08a41973a131f7a2fb","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-8r6m-32jq-jx6q","aliases":["CVE-2026-73569"],"title":"fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits","description":"### Impact\n`fast-xml-parser` processes multiple \"DOCTYPE\" declarations within a single XML document. Each declaration passes its entities to `@nodable/entities` through `addInputEntities()`.\n\n`addInputEntities()` resets the entity expansion counters every time it is called. An attacker can therefore insert additional DOCTYPE declarations to repeatedly reset maxTotalExpansions and maxExpandedLength during one parse operation.\n\nThis allows a crafted XML document to exceed the configured entity-expansion limits and can cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination.\n\n### Workarounds\n- Manually check if multiple DOCTYPEs are not present in input contents\n- Update to v5.10.1\n- Keep `processEntity` flag off","state":0,"publishedAt":"2026-07-21T22:06:36+00:00","modifiedAt":"2026-09-10T03:51:11.0960458+00:00","affected":[{"ecosystem":"npm","name":"fast-xml-parser","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"5.9.3"},{"kind":"fixed","version":"5.10.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q","https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f","https://github.com/NaturalIntelligence/fast-xml-parser","https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1"],"sourceUrl":"https://github.com/advisories/GHSA-8r6m-32jq-jx6q","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-8r6m-32jq-jx6q","identifiers":["GHSA-8r6m-32jq-jx6q","CVE-2026-73569"]},"retained":false,"historicalAffected":[]}],"coverage":[]}