Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-73569— fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

Quick assessment

Affected
NaturalIntelligence fast-xml-parser
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

fast-xml-parser 允许用户无需依赖 C/C++ 基础库或回调机制，即可通过 JavaScript 对象处理 XML。在版本 5.9.3 至 5.10.1 之间， 会处理单个 XML 文档中出现的多个 DOCTYPE 声明，并通过 函数传递每个声明中的实体。然而， 每次被调用时都会重置 （最大总展开次数）和 （最大展开长度），这使得攻击者可以在一次解析操作期间，通过引入额外的 DOCTYPE 声明反复重置已配置的实体展开限制。利用精心构造的 XML 文档，可导致 CPU 使用率过高、事件循环阻塞、内存耗

CVSS 8.7 · High EPSS 0.51% · P41

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking

Affected Version Matrix 1

VendorProduct Version RangeStatus
NaturalIntelligence fast-xml-parser >= 5.9.3, < 5.10.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-73569

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
Source: CVE Program / CVE List V5
Vulnerability Description
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
DTD中递归实体索引的不恰当限制(XML实体扩展)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
NaturalIntelligence fast-xml-parser >= 5.9.3, < 5.10.1 -

II. Public POCs for CVE-2026-73569

# POC Description Source Link Shenlong Link
AI-Generated POC Verified env Premium
Qwen3.6-35B-A3B · 9360 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-73569

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-73569 (1)

Vendor Advisories for CVE-2026-73569 (1)

Vendor Pages for CVE-2026-73569 (1)

IV. Related Vulnerabilities

Same product: fast-xml-parser
Same vendor: NaturalIntelligence
Same weakness: CWE-776

V. Comments for CVE-2026-73569

No comments yet

Leave a comment