GHSA-8r6m-32jq-jx6q

Summary

fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

Severity

high

CWE

CWE-776

Published

2026-07-21

Updated

2026-07-21

Advisory details

Impact

fast-xml-parser processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to @nodable/entities through addInputEntities().

addInputEntities() resets the entity expansion counters every time it is called. An attacker can therefore insert additional DOCTYPE declarations to repeatedly reset maxTotalExpansions and maxExpandedLength during one parse operation.

This allows a crafted XML document to exceed the configured entity-expansion limits and can cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination.

Workarounds

• Manually check if multiple DOCTYPEs are not present in input contents
• Update to v5.10.1
• Keep processEntity flag off

References

• https://github.com/advisories/GHSA-8r6m-32jq-jx6q
• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q
• https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f
• https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1

Related advisories

• CVE-2026-41650 — medium · npm/fast-xml-parser
• CVE-2026-78681 — high · PyPI/nltk
• CVE-2026-54077 — high · Maven/com.arcadedb:arcadedb-engine

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity