GHSA-8r6m-32jq-jx6qHigh▾ Twilightfast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
fast-xml-parser processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to @nodable/entities through addInputEntities().
addInputEntities() resets the entity expansion counters every time it is called. An attacker can therefore insert additional DOCTYPE declarations to repeatedly reset maxTotalExpansions and maxExpandedLength during one parse operation.
This allows a crafted XML document to exceed the configured entity-expansion limits and can cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination.
processEntity flag offfast-xml-parser >= 5.9.3, < 5.10.1Upgrade to a patched release:
fast-xml-parser 5.10.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73569High· 7.5fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks
CVE-2026-26278High· 7.5fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback
CVE-2026-25896Critical· 9.3fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback
CVE-2026-5079High· 7.5multer: Multer: Denial of Service via deeply nested field names in multipart form data (CVE-2026-5079)
CVE-2026-115506High· 7.5libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay
CVE-2026-108357High· 8.8PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service