CVE-2026-73569
Fixed in a distro release EPSS <1%CVSS 8.7
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.
Products: NaturalIntelligence fast-xml-parser
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | fast-xml-parser | 5.10.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | jitsucom-jitsu-console | 2.11.0-r30 |
| Chainguard | kibana-9.0 | 9.0.8-r34 |
| Chainguard | kibana-9.0-bitnami | 9.0.8-r34 |
| Chainguard | kibana-9.0-iamguarded | 9.0.8-r34 |
| Chainguard | kibana-9.2 | 9.2.8-r17 |
| Chainguard | kibana-9.2-iamguarded | 9.2.8-r17 |
| Chainguard | langfuse-2-worker | 2.95.12-r35 |
| Chainguard | langfuse-fips-2-worker | 2.95.12-r38 |
| Chainguard | thingsboard-tb-js-executor-fips | 4.3.1.3-r3 |
| Chainguard | tileserver-gl | 5.6.0-r10 |
| Chainguard | tileserver-gl-fips | 5.6.0-r9 |
| Debian 13 | node-webfont | no fix |
| Debian 14 | node-webfont | no fix |
| Ubuntu 24.04 LTS | node-webfont | no fix |
| Ubuntu 26.04 LTS | node-webfont | no fix |
| Ubuntu 26.10 | node-webfont | no fix |
| Wolfi | jitsucom-jitsu-console | 2.11.0-r30 |
| Wolfi | tileserver-gl | 5.6.0-r10 |