EUVD-2026-58184
GHSA-8r6m-32jq-jx6q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with no auth, no complexity, and no user interaction; impact is pure availability (DoS) within unchanged scope - no confidentiality or integrity consequence.
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4Blast Radius
ecosystem impact- 139 npm packages depend on fast-xml-parser (26 direct, 113 indirect)
Ecosystem-wide dependent count for version 5.9.3.
DescriptionCVE.org
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.
AnalysisAI
Entity expansion limit bypass in fast-xml-parser 5.9.3-5.10.0 enables remote unauthenticated denial of service against any Node.js service parsing untrusted XML. The parser's OrderedObjParser.js passes each encountered DOCTYPE declaration through addInputEntities(), which reinitializes the entity-expansion safety counters (maxTotalExpansions, maxExpandedLength) on every call - a crafted document with multiple DOCTYPE blocks therefore resets these guards to zero repeatedly within a single parse operation, nullifying protections against billion-laughs-style exponential entity expansion. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application uses fast-xml-parser version 5.9.3 through 5.10.0 and that the processEntity parser option is not explicitly set to false (entity processing is enabled by default). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VA:H accurately characterizes this vulnerability: network-reachable with no complexity, no authentication, no user interaction required, and high availability impact confined to the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting a Node.js web service that accepts XML input - such as a SOAP API endpoint, an XML file upload processor, or an RSS/Atom feed ingestion worker - submits a crafted XML document containing two or more DOCTYPE declarations, each defining entities that reference other entities exponentially (a classic billion-laughs structure). Because each successive DOCTYPE resets the parser's expansion counters, all entity references resolve without the configured limits, driving CPU utilization to 100%, exhausting the process heap, and eventually crashing or permanently stalling the Node.js event loop. … |
| Remediation | Upgrade fast-xml-parser to version 5.10.1 or later; this is the vendor-released patch as confirmed by the GitHub release tag at https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1 and the fix commit at https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Node.js applications using fast-xml-parser via dependency scanning (npm ls fast-xml-parser) and identify systems running versions 5.9.3 through 5.10.0. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Not-Affected |
| SUSE Linux Enterprise Server 16.1 | Not-Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Not-Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Not-Affected |
| openSUSE Leap 16.0 | Not-Affected |
Share
External POC / Exploit Code
Leaving vuln.today