Which versions of fast-xml-parser are affected by CVE-2026-73569?

fast-xml-parser versions 5.9.3-5.10.0 contain a critical entity-expansion flaw that allows attackers to remotely crash any Node.js service using the library without authentication by submitting…. A patch is available.

How to fix or mitigate CVE-2026-73569?

Within 24 hours, inventory all Node.js applications using fast-xml-parser via dependency scanning (npm ls fast-xml-parser) and identify systems running versions 5.9.3 through 5.10.0. Over the next 7 days, evaluate an immediate upgrade to versions outside the affected range if dependency constraints permit, or if versions must be retained, implement compensating controls including strict DOCTYPE declaration filtering, XML schema validation for untrusted input streams, and XML payload size limits. Within 30 days, complete the library upgrade or finalize and validate layered input controls in production; additionally deploy Web Application Firewall rules to block entity-expansion attack patterns and implement application-level request rate limiting (2-5 second timeout maximum) and payload size enforcement (1-10 MB maximum) for all XML parsing operations.

fast-xml-parser CVE-2026-73569

Q: What is the CVSS score of CVE-2026-73569?

CVE-2026-73569 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-58184 HIGH

Improper Restriction of Recursive Entity References in DTDs (CWE-776)

2026-08-13 security-advisories@github.com

GHSA-8r6m-32jq-jx6q

Information Disclosure Red Hat Suse

8.7

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-accessible with no auth, no complexity, and no user interaction; impact is pure availability (DoS) within unchanged scope - no confidentiality or integrity consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 13, 2026 - 19:04 EUVD

Source Code Evidence Fetched

Aug 13, 2026 - 18:32 vuln.today

Analysis Generated

Aug 13, 2026 - 18:32 vuln.today

CVE Published

Aug 13, 2026 - 18:18 cve.org

HIGH 8.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

139 npm packages depend on fast-xml-parser (26 direct, 113 indirect)

Ecosystem-wide dependent count for version 5.9.3.

DescriptionCVE.org

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.

AnalysisAI

Entity expansion limit bypass in fast-xml-parser 5.9.3-5.10.0 enables remote unauthenticated denial of service against any Node.js service parsing untrusted XML. The parser's OrderedObjParser.js passes each encountered DOCTYPE declaration through addInputEntities(), which reinitializes the entity-expansion safety counters (maxTotalExpansions, maxExpandedLength) on every call - a crafted document with multiple DOCTYPE blocks therefore resets these guards to zero repeatedly within a single parse operation, nullifying protections against billion-laughs-style exponential entity expansion. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify target service accepting untrusted XML input

Delivery

Craft XML document with multiple DOCTYPE declarations containing exponential entity references

Exploit

Submit crafted payload to the parser endpoint

Execution

Each DOCTYPE resets addInputEntities() counters to zero

Persist

Entity expansion proceeds without configured limits

Impact

CPU exhaustion and heap overflow block or crash the Node.js process

Access

Identify target service accepting untrusted XML input

Delivery

Craft XML document with multiple DOCTYPE declarations containing exponential entity references

Exploit

Submit crafted payload to the parser endpoint

Execution

Each DOCTYPE resets addInputEntities() counters to zero

Persist

Entity expansion proceeds without configured limits

Impact

CPU exhaustion and heap overflow block or crash the Node.js process

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the target application uses fast-xml-parser version 5.9.3 through 5.10.0 and that the processEntity parser option is not explicitly set to false (entity processing is enabled by default). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VA:H accurately characterizes this vulnerability: network-reachable with no complexity, no authentication, no user interaction required, and high availability impact confined to the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker targeting a Node.js web service that accepts XML input - such as a SOAP API endpoint, an XML file upload processor, or an RSS/Atom feed ingestion worker - submits a crafted XML document containing two or more DOCTYPE declarations, each defining entities that reference other entities exponentially (a classic billion-laughs structure). Because each successive DOCTYPE resets the parser's expansion counters, all entity references resolve without the configured limits, driving CPU utilization to 100%, exhausting the process heap, and eventually crashing or permanently stalling the Node.js event loop. …
Remediation	Upgrade fast-xml-parser to version 5.10.1 or later; this is the vendor-released patch as confirmed by the GitHub release tag at https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1 and the fix commit at https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Node.js applications using fast-xml-parser via dependency scanning (npm ls fast-xml-parser) and identify systems running versions 5.9.3 through 5.10.0. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-776 – Improper Restriction of Recursive Entity References in DTDs

View all

CVE-2025-3225 HIGH POC

7.5

CVE-2026-26278 HIGH POC

7.5

CVE-2026-29074 HIGH POC

7.5

CVE-2023-49967 HIGH POC

7.5

CVE-2022-25857 HIGH POC

7.5

CVE-2022-0217 HIGH POC

7.5

CVE-2020-5227 HIGH POC

7.5

CVE-2019-12401 HIGH POC

7.5

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Server 16.0	Not-Affected
SUSE Linux Enterprise Server 16.1	Not-Affected
SUSE Linux Enterprise Server for SAP applications 16.0	Not-Affected
SUSE Linux Enterprise Server for SAP applications 16.1	Not-Affected
openSUSE Leap 16.0	Not-Affected

CVE-2026-73569 vulnerability details – vuln.today

Back

fast-xml-parser CVE-2026-73569

Severity by source

CVSS VectorVendor: github

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same weakness CWE-776 – Improper Restriction of Recursive Entity References in DTDs

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code