GHSA-8r6m-32jq-jx6q
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
Summary
### Impact `fast-xml-parser` processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to `@nodable/entities` through `addInputEntities()`. `addInputEntities()` resets the entity expansion counters every time it is called. An attacker can therefore insert additional DOCTYPE declarations to repeatedly reset maxTotalExpansions and maxExpandedLength during one parse operation. This allows a crafted XML document to exceed the configured entity-expansion limits and can cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. ### Workarounds - Manually check if multiple DOCTYPEs are not present in input contents - Update to v5.10.1 - Keep `processEntity` flag off
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| npm | fast-xml-parser | — | 5.10.1 |
Remediation: Upgrade to 5.10.1 or later.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.