Is CVE-2026-73569 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73569 being exploited in the wild.

How severe is CVE-2026-73569?

Medium severity, with a CVSS score of 4, published 13 August 2026.

Which products and versions are affected?

fast-xml-parser (npm) SEMVER:introduced=5.9.3,fixed=5.10.1.

Is there a fix for CVE-2026-73569?

Yes. fast-xml-parser (npm): upgrade to 5.10.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73569 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-73569?

Check whether you run fast-xml-parser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73569: fast-xml-parser DOCTYPE reset entity expansion limits bypass

CVE-2026-73569 · Severity: medium · CVSS 4 · Published 2026-08-13

fast-xml-parser is a popular JavaScript library used to parse XML documents in web applications and services. An attacker can craft an XML file with multiple DOCTYPE declarations to reset security limits on entity expansion, bypassing protections designed to prevent denial-of-service attacks. This can cause the application to consume excessive CPU, memory, and processing resources, potentially crashing the service.

Technologies: fast-xml-parser (npm). Vendors: npm.

Quick answers

Is CVE-2026-73569 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73569 being exploited in the wild.
How severe is CVE-2026-73569?: Medium severity, with a CVSS score of 4, published 13 August 2026.
Which products and versions are affected?: fast-xml-parser (npm) SEMVER:introduced=5.9.3,fixed=5.10.1.
Is there a fix for CVE-2026-73569?: Yes. fast-xml-parser (npm): upgrade to 5.10.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73569 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-73569?: Check whether you run fast-xml-parser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fast-xml-parser (npm): upgrade to 5.10.1 or later
```
npm install fast-xml-parser@5.10.1
```

Technical details

The vulnerability exists in how fast-xml-parser handles multiple DOCTYPE declarations within a single XML document. Each DOCTYPE declaration triggers addInputEntities() to pass entities to the @nodable/entities module, but this function resets entity expansion counters (maxTotalExpansions and maxExpandedLength) each time it is called. An attacker can insert multiple DOCTYPE declarations in a crafted XML payload to repeatedly reset these limits during parsing, allowing unbounded entity expansion that violates the configured security constraints. This results in excessive CPU consumption, event-loop blocking, memory exhaustion, and process termination. The vulnerability affects versions 5.9.3 through 5.10.0 and is fixed in version 5.10.1.

Affected products

NaturalIntelligence fast-xml-parser 5.9.3 through 5.10.0

Identifiers

CVE-2026-73569
GHSA-8r6m-32jq-jx6q

Timeline

2026-07-21: disclosed
2026-07-21: patched: v5.10.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.