NaturalIntelligence fast-xml-parser up to 5.10.0 XML Parser OrderedObjParser.js addInputEntities resource consumption

Summaryinfo

A vulnerability was found in NaturalIntelligence fast-xml-parser up to 5.10.0. It has been classified as problematic. The impacted element is the function addInputEntities of the file src/xmlparser/OrderedObjParser.js of the component XML Parser. This manipulation causes resource consumption. This vulnerability is tracked as CVE-2026-73569. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as problematic was found in NaturalIntelligence fast-xml-parser up to 5.10.0. Affected by this vulnerability is the function addInputEntities of the file src/xmlparser/OrderedObjParser.js of the component XML Parser. The manipulation with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. The summary by CVE is:

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-73569 since 08/12/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 5.10.1 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• NaturalIntelligence

Name

• fast-xml-parser

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6
• 5.7
• 5.8
• 5.9
• 5.10.0

Website

• Product: https://github.com/NaturalIntelligence/fast-xml-parser/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion