# CVE-2026-73569: fast-xml-parser DOCTYPE reset entity expansion limits bypass

Source: https://junglewise.ai/threats/cve-2026-73569-fast-xml-parser-doctype-reset-entity-expansion-limits-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73569 · Severity: medium · CVSS 4 · Published 2026-08-13

fast-xml-parser is a popular JavaScript library used to parse XML documents in web applications and services. An attacker can craft an XML file with multiple DOCTYPE declarations to reset security limits on entity expansion, bypassing protections designed to prevent denial-of-service attacks. This can cause the application to consume excessive CPU, memory, and processing resources, potentially crashing the service.

Technologies: [fast-xml-parser (npm)](https://junglewise.ai/threats/technologies/fast-xml-parser). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-73569 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73569 being exploited in the wild.

**How severe is CVE-2026-73569?** Medium severity, with a CVSS score of 4, published 13 August 2026.

**Which products and versions are affected?** fast-xml-parser (npm) SEMVER:introduced=5.9.3,fixed=5.10.1.

**Is there a fix for CVE-2026-73569?** Yes. fast-xml-parser (npm): upgrade to 5.10.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73569 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-73569?** Check whether you run fast-xml-parser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fast-xml-parser (npm): upgrade to 5.10.1 or later

  ```sh
  npm install fast-xml-parser@5.10.1
  ```


## Technical details

The vulnerability exists in how fast-xml-parser handles multiple DOCTYPE declarations within a single XML document. Each DOCTYPE declaration triggers addInputEntities() to pass entities to the @nodable/entities module, but this function resets entity expansion counters (maxTotalExpansions and maxExpandedLength) each time it is called. An attacker can insert multiple DOCTYPE declarations in a crafted XML payload to repeatedly reset these limits during parsing, allowing unbounded entity expansion that violates the configured security constraints. This results in excessive CPU consumption, event-loop blocking, memory exhaustion, and process termination. The vulnerability affects versions 5.9.3 through 5.10.0 and is fixed in version 5.10.1.

## Affected products

- NaturalIntelligence fast-xml-parser 5.9.3 through 5.10.0

## Identifiers

- CVE-2026-73569
- GHSA-8r6m-32jq-jx6q

## Timeline

- 2026-07-21: disclosed
- 2026-07-21: patched: v5.10.1

## References

- [https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q](https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q)
- [https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f](https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f)

## Related threats

- [fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags](https://junglewise.ai/threats/cve-2026-126066-fast-xml-parser-allows-users-to-process-xml-from-js-object)
- [NaturalIntelligence fast-xml-parser XML injection in XMLBuilder](https://junglewise.ai/threats/cve-2026-41650-naturalintelligence-fast-xml-parser-xml-injection-in-xmlbuilder)
- [fast-xml-parser entity expansion bypass via falsy zero check](https://junglewise.ai/threats/cve-2026-33349-fast-xml-parser-entity-expansion-bypass-via-falsy-zero-check)
- [fast-xml-parser numeric entity expansion bypass](https://junglewise.ai/threats/cve-2026-33036-fast-xml-parser-numeric-entity-expansion-bypass)
- [NaturalIntelligence fast-xml-parser stack overflow in XMLBuilder](https://junglewise.ai/threats/cve-2026-27942-naturalintelligence-fast-xml-parser-stack-overflow-in-xmlbuilder)