Executive brief
fast-xml-parser is a popular JavaScript library used to parse XML documents in web applications and services. An attacker can craft an XML file with multiple DOCTYPE declarations to reset security limits on entity expansion, bypassing protections designed to prevent denial-of-service attacks. This can cause the application to consume excessive CPU, memory, and processing resources, potentially crashing the service.
Technical details
The vulnerability exists in how fast-xml-parser handles multiple DOCTYPE declarations within a single XML document. Each DOCTYPE declaration triggers addInputEntities() to pass entities to the @nodable/entities module, but this function resets entity expansion counters (maxTotalExpansions and maxExpandedLength) each time it is called. An attacker can insert multiple DOCTYPE declarations in a crafted XML payload to repeatedly reset these limits during parsing, allowing unbounded entity expansion that violates the configured security constraints. This results in excessive CPU consumption, event-loop blocking, memory exhaustion, and process termination. The vulnerability affects versions 5.9.3 through 5.10.0 and is fixed in version 5.10.1.
Affected products
- NaturalIntelligence fast-xml-parser 5.9.3 through 5.10.0
Timeline
- 2026-07-21: disclosed
- 2026-07-21: patched: v5.10.1