fast-xml-parser CVE-2026-73569

Exploitation requires that the target application uses fast-xml-parser version 5.9.3 through 5.10.0 and that the processEntity parser option is not explicitly set to false (entity processing is enabled by default). No authentication, elevated network position, user interaction, or non-default deployment configuration is required beyond these two conditions - any code path that delivers attacker-controlled XML bytes to the parser's parse() method is a viable attack surface. Exploitation is limited by the processEntity flag: deployments with { processEntity: false } disable the entity-processing pipeline and are not vulnerable to this counter-reset bypass. Additionally, services that exclusively parse internally generated or otherwise fully trusted XML documents face no practical risk regardless of version, as the attack requires the attacker to control the DOCTYPE content of the parsed document.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VA:H accurately characterizes this vulnerability: network-reachable with no complexity, no authentication, no user interaction required, and high availability impact confined to the vulnerable system. Impact is limited to availability (VA:H); confidentiality and integrity are unaffected (VC:N/VI:N), confirming a pure denial-of-service profile. No EPSS score was supplied in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified from this dataset. The vulnerability is absent from CISA KEV and no public exploit code has been identified, indicating no confirmed mass exploitation at time of analysis. However, the exploitation bar is very low - a crafted XML payload suffices - so any internet-exposed endpoint passing untrusted XML to the affected versions faces meaningful practical risk. One substantive limiting factor is the processEntity option: deployments explicitly setting processEntity: false disable entity processing entirely and are not exposed to this counter-reset path. The availability of a patched release (5.10.1) and the existence of a configuration-based workaround make remediation straightforward, reducing residual risk significantly once either is applied.

An attacker targeting a Node.js web service that accepts XML input - such as a SOAP API endpoint, an XML file upload processor, or an RSS/Atom feed ingestion worker - submits a crafted XML document containing two or more DOCTYPE declarations, each defining entities that reference other entities exponentially (a classic billion-laughs structure). Because each successive DOCTYPE resets the parser's expansion counters, all entity references resolve without the configured limits, driving CPU utilization to 100%, exhausting the process heap, and eventually crashing or permanently stalling the Node.js event loop. No public exploit code has been identified, but the fix commit reveals the exact code path, making proof-of-concept construction straightforward for a knowledgeable attacker.