Read the docs
TI-2026-51659 Aliases CVE-2026-73569GHSA-8r6m-32jq-jx6q

fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

Priority MEDIUM 44CWE-776Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 4 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00507 43rd percentileScored 2026-11-07
Fix Partial fast-xml-parser (NaturalIntelligence): 5.10.1fast-xml-parser (npm): 5.10.1Red Hat: 4 advisoriesRed Hat: 4 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NaturalIntelligencefast-xml-parser5.9.3 to before 5.10.15.10.1Patch availableCNA
—fast-xml-parser (npm)5.9.3 to before 5.10.15.10.1Patch availableGHSA-8r6m-32jq-jx6q
  • fast-xml-parser VendorNaturalIntelligence Affected 5.9.3 to before 5.10.1 Fixed in 5.10.1 Patch available CNA
  • fast-xml-parser (npm) Vendor— Affected 5.9.3 to before 5.10.1 Fixed in 5.10.1 Patch available GHSA-8r6m-32jq-jx6q

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*——NaturalIntelligence
  • cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:* Versions — — ·NaturalIntelligence

Remediation

  • Fix · CNA fast-xml-parser (NaturalIntelligence) Fixed in 5.10.1
  • Fix · GHSA-8r6m-32jq-jx6q fast-xml-parser (npm) Fixed in 5.10.1 Advisory →

Red Hat 4 advisories

  • RHSA-2026:92650 Released 2026-10-29 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.26 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:67724 Released 2026-09-16 · Red Hat rating Important
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.2 registry.redhat.io/mta/mta-ui-rhel9
  • RHSA-2026:66003 Released 2026-09-09 · Red Hat rating Important
    Ansible automation portal Red Hat Enterprise Linux Images
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9
Show 1 more Red Hat advisories
  • RHSA-2026:65130 Released 2026-09-08 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.22.3 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +25

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat Ansible Automation Platform 2.2Fixed RHSA-2026:66003
Red Hat Migration Toolkit for Applications 8.2Fixed RHSA-2026:67724
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:92650
Red Hat Openshift Data Foundation 4.22Fixed RHSA-2026:65130
Not affected: 10 products
  • Cryostat 4
  • Red Hat Advanced Cluster Security 4
  • Red Hat Developer Hub 1
  • Red Hat Migration Toolkit for Applications 8.2
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift Virtualization 4
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Openshift Data Foundation 4.22
  • Red Hat build of Apicurio Registry 3
  • Self-service automation portal 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-73569
  2. 2026-10-03 Alias added: GHSA-8r6m-32jq-jx6q
  3. 2026-10-16 Affected versions changed · Red Hat
  4. 2026-10-27 Affected versions changed · Red Hat
  5. 2026-10-30 Fix available: Red Hat Openshift Data Foundation 4.19 · Red Hat
  6. 2026-10-31 Fix available: RHSA-2026:92650 · Red Hat

References

Other 4

  • TI-2026-20935 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names CVSS 3.1CRITICAL 9.3
  • TI-2026-25482 fast-xml-parser affected by numeric entity expansion bypassing all entity expansion… CVSS 3.1HIGH 7.5
  • TI-2026-20291 fast-xml-parser has RangeError DoS Numeric Entities Bug CVSS 3.1HIGH 7.5
  • TI-2026-32565 fast-xml-builder: Attribute values with unwanted quotes can bypass malicious or unwanted attributes CVSS 3.1MEDIUM 6.1
  • TI-2026-30169 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters CVSS 3.1MEDIUM 6.1
  • TI-2026-25755 fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation CVSS 3.1MEDIUM 5.9
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences