Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-73569 Denial-of-Service Vulnerability in fast-xml-parser via Multiple DOCTYPE Declarations https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-73569
Post summary
The text announces CVE‑2026‑73569, a denial‑of‑service flaw in fast‑xml‑parser caused by multiple DOCTYPE declarations, but provides no PoC, exploit, active exploitation, patch, or debunking information.