NaturalIntelligence fast-xml-parser entity expansion limit bypass

Executive brief

A vulnerability in the fast-xml-parser library, which is used to process XML data in many applications, allows an attacker to crash the service or cause it to become unresponsive. By sending a specially crafted XML file with multiple document type declarations, an attacker can bypass security limits and exhaust the system's memory and processing power. This can lead to a complete denial of service, impacting business operations and application availability.

Technical details

The fast-xml-parser library fails to properly restrict recursive entity references when multiple DOCTYPE declarations are present in a single XML document. Each declaration triggers a call to addInputEntities() in the @nodable/entities dependency, which incorrectly resets the maxTotalExpansions and maxExpandedLength counters. An attacker can exploit this by providing a crafted XML document that repeatedly resets these limits, allowing for an unbounded entity expansion attack (CWE-776). This results in excessive CPU usage, event-loop blocking, and memory exhaustion. The issue is fixed in version 5.10.1.

Affected products

• NaturalIntelligence fast-xml-parser >= 5.9.3, < 5.10.1

Timeline

• 2026-07-16: disclosed
• 2026-07-21: advisory: GitHub Advisory published
• 2026-07-21: patched: Version 5.10.1 released

References

• https://api.github.com/users/the-vibe-dev
• https://github.com/the-vibe-dev
• https://api.github.com/users/the-vibe-dev/gists%7B/gist_id%7D
• https://api.github.com/users/the-vibe-dev/repos
• https://avatars.githubusercontent.com/u/38411158?v=4
• https://api.github.com/users/the-vibe-dev/events%7B/privacy%7D