fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

Description

fast-xml-parser processes multiple “DOCTYPE” declarations within a single XML document. Each declaration passes its entities to @nodable/entities through addInputEntities().

addInputEntities() resets the entity expansion counters every time it is called.

Recommendation

Update the fast-xml-parser package to the latest compatible version. Followings are version details:

• Affected version(s): >= 5.9.3, < 5.10.1
• Patched version(s): 5.10.1

References

• GHSA-8r6m-32jq-jx6q
• CVE-2026-73569
• CWE-776
• CAPEC-310
• OWASP 2021-A5
• OWASP 2021-A6

Related Issues

• Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser - CVE-2026-33349
• fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) - CVE-2026-26278
• fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026- - CVE-2026-33036
• fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names - CVE-2026-25896

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

fast-xml-parser