Answer in brief
CVE-2026-73569 records a High severity vulnerability in fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits. The current sources do not mark it as known exploited. The current feed maps NaturalIntelligence/fast-xml-parser (generic), fast-xml-parser (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps NaturalIntelligence/fast-xml-parser (generic), fast-xml-parser (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| NaturalIntelligence/fast-xml-parsergeneric | >= 5.9.3, < 5.10.1 | Not reported |
| fast-xml-parsernpm | >=5.9.3,<5.10.1 | 5.10.1 |
Published upstream
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 13, 2026
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-73569 records a High severity vulnerability in fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits. The current sources do not mark it as known exploited. The current feed maps NaturalIntelligence/fast-xml-parser (generic), fast-xml-parser (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps NaturalIntelligence/fast-xml-parser (generic), fast-xml-parser (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| NaturalIntelligence/fast-xml-parsergeneric | >= 5.9.3, < 5.10.1 | Not reported |
| fast-xml-parsernpm | >=5.9.3,<5.10.1 | 5.10.1 |
Published upstream
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 13, 2026
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.
Quoted source text, attributed separately from HOL analysis.