CVE-2026-73569

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-776"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73569.json"
}

References

Affected packages

Git / github.com/naturalintelligence/fast-xml-parser

Affected ranges

Type

GIT

Repo

https://github.com/naturalintelligence/fast-xml-parser

Events

Introduced

93a09f108d6f457a84e607a6806a7bfd6abc3e55

Fixed

2ce7191ef0f96473b8c7e0c384fbc4ad34a222de

Fixed

4e546e03987662de5495d050b5fba26bea65383f

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "5.9.3"
                },
                {
                    "fixed":  "5.10.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "4e546e03987662de5495d050b5fba26bea65383f"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v5.10.1",
            "range":  [
                {
                    "fixed":  "2ce7191ef0f96473b8c7e0c384fbc4ad34a222de"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v5.*

v5.10.0

v5.9.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73569.json"