CVE-2026-73569
Received Received - Intake

fast-xml-parser Billion Laughs DoS via DOCTYPE Expansion

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-09-03
AI Q&A
2026-08-13
EPSS Evaluated
2026-09-01
NVD
CVE-2026-73569
EUVD
EUVD-2026-58184

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
naturalintelligence fast-xml-parser From 5.9.3 (inc) to 5.10.1 (inc)
naturalintelligence fast-xml-parser 5.10.1
fast-xml-parser fast-xml-parser From 5.9.3 (inc) to 5.10.1 (inc)
fast-xml-parser fast-xml-parser 5.10.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-776 The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in fast-xml-parser allows attackers to bypass entity expansion limits by including multiple DOCTYPE declarations in an XML document. Each DOCTYPE resets the configured limits, causing excessive CPU usage, memory exhaustion, and process termination.

Detection Guidance

To detect this vulnerability, inspect XML input for multiple DOCTYPE declarations. Use tools like grep to search for DOCTYPE patterns in XML files or network traffic. Example command: grep -r 'DOCTYPE' /path/to/xml/files. If using fast-xml-parser, enable validation to reject multiple DOCTYPEs.

Impact Analysis

It can lead to denial-of-service conditions by consuming excessive system resources, crashing applications, or blocking the event loop. Systems processing untrusted XML inputs are particularly at risk.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks through excessive CPU and memory usage during XML parsing. GDPR requires data processing systems to ensure availability and integrity of personal data, while HIPAA mandates safeguards against service disruptions. The vulnerability's potential to cause process termination or blocking may violate these requirements.

Mitigation Strategies

Update fast-xml-parser to version 5.10.1 or later. If updating is not possible, disable the processEntity flag or manually validate XML input to reject documents with multiple DOCTYPE declarations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73569. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart