DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-8R6M-32JQ-JX6Q: GHSA-8R6M-32JQ-JX6Q: XML Entity Expansion Bypass in fast-xml-parser via Repeated DOCTYPE Declarations

#security #cve #cybersecurity #ghsa

GHSA-8R6M-32JQ-JX6Q: XML Entity Expansion Bypass in fast-xml-parser via Repeated DOCTYPE Declarations

Vulnerability ID: GHSA-8R6M-32JQ-JX6Q
CVSS Score: 8.7
Published: 2026-07-21

A Denial of Service (DoS) vulnerability has been identified in the Node.js XML parsing library fast-xml-parser. The flaw allows unauthenticated remote attackers to cause severe CPU exhaustion, event-loop blocking, and system crashes by sending a crafted XML payload containing repeated DOCTYPE declarations that bypass recursive entity expansion protections.

TL;DR

Unauthenticated remote attackers can cause denial of service and crash fast-xml-parser applications by using repeated DOCTYPE declarations to bypass XML entity expansion limits.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-776 / CWE-400
  • Attack Vector: Network (AV:N)
  • CVSS v4.0 Score: 8.7 (High)
  • Exploit Status: Proof of Concept (PoC) available
  • KEV Status: Not listed on CISA KEV
  • Impact: Denial of Service (DoS) / Single-Thread Blocking

Affected Systems

  • fast-xml-parser (npm package)
  • fast-xml-parser: >= 5.9.3, < 5.10.1 (Fixed in: 5.10.1)

Code Analysis

Commit: 4e546e0

Enforce single DOCTYPE declaration validation check

Exploit Details

Mitigation Strategies

  • Upgrade fast-xml-parser to version 5.10.1 or later.
  • Disable processEntities parameter in the parser options to prevent custom entity expansion.
  • Implement input validation at the gateway level to drop payloads containing multiple DOCTYPE elements.

Remediation Steps:

  1. Run npm install fast-xml-parser@5.10.1 to update the dependency.
  2. Inspect codebase for instantiation of XMLParser and verify processEntities option is set to false if DTD parsing is not strictly required.
  3. Deploy reverse-proxy or API Gateway filters to reject multiple DOCTYPE elements.

References

Read the full report for GHSA-8R6M-32JQ-JX6Q on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)