VDB
CVE-2026-73569
CVE-2026-73569
PUBLISHED
CVSS 8.7 HIGH
Reported by GitHub_M · Published August 13, 2026
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.
Risk Scores
CVSS 4.0
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| NaturalIntelligence | fast-xml-parser | >= 5.9.3, < 5.10.1 |
| chainguard | jitsucom-jitsu | 0, 0, 0 |
| chainguard | langfuse-fips-2 | 0, 0, 0 |
| chainguard | kibana-9.0 | 0, 0, 0 |
| chainguard | langfuse-2 | 0, 0, 0 |
| chainguard | tileserver-gl-fips | 0, 0, 0 |
| NaturalIntelligence | fast-xml-parser | >= 5.9.3, < 5.10.1 |
| chainguard | tileserver-gl | 0, 0, 0 |
| chainguard | thingsboard-fips | 0, 0, 0 |
| chainguard | kibana-9.2 | 0, 0, 0 |
| wolfi | tileserver-gl | 0, 0, 0 |
| wolfi | jitsucom-jitsu | 0, 0, 0 |
Timeline
- Jul 21, 2026 CVE Published
- Aug 13, 2026 Coalition ESS Score
- Aug 13, 2026 CVE Updated
- Aug 14, 2026 Security Advisory
- Aug 24, 2026 EPSS Score
- Aug 26, 2026 EPSS Score
- Aug 30, 2026 EPSS Score
- Sep 3, 2026 EPSS Score
- Sep 7, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
References
- https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q x_refsource_CONFIRM
- https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f x_refsource_MISC
- https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1 x_refsource_MISC