CVE-2026-73569 fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

CVE-2026-73569

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

CVE-2026-73569

CVE-2026-73569 affects fast-xml-parser (OrderedObjParser.js). When parsing a single XML with multiple DOCTYPE declarations (versions 5.9.3–5.10.1), addInputEntities() repeatedly resets entity-expansion limits, allowing repeated resets within one parse. This can cause excessive CPU use, event-loop...

EUVD-2026-58184

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

CVE-2026-73569: Improper Restriction of Recursive Entity References in DTDs

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

PT-2026-71719

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

CLSA-2026-1786525960 TuxCare security update for fast-xml-parser (1 CVE)

TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.7-tuxcare.2...

PT-2026-80102

TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.7-tuxcare.2...

CLSA-2026-1786373314 TuxCare security update for fast-xml-parser (1 CVE)

TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.3-tuxcare.5...

CLSA-2026-1784856386 TuxCare security update for fast-xml-parser (1 CVE)

TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.7-tuxcare.1...

CLSA-2026-1781744124 TuxCare security update for fast-xml-parser (2 CVEs)

TuxCare rebuilt fast-xml-parser to address 2 CVEs. Fixed in 3.17.5-tuxcare.1...

CLSA-2026-1781744139 TuxCare security update for fast-xml-parser (7 CVEs)

TuxCare rebuilt fast-xml-parser to address 7 CVEs. Fixed in 4.4.0-tuxcare.1...

CLSA-2026-1781744123 TuxCare security update for fast-xml-parser (2 CVEs)

TuxCare rebuilt fast-xml-parser to address 2 CVEs. Fixed in 3.19.0-tuxcare.1...

CLSA-2026-1781744131 TuxCare security update for fast-xml-parser (2 CVEs)

TuxCare rebuilt fast-xml-parser to address 2 CVEs. Fixed in 3.14.0-tuxcare.1...

CLSA-2026-1781744119 TuxCare security update for fast-xml-parser (6 CVEs)

TuxCare rebuilt fast-xml-parser to address 6 CVEs. Fixed in 4.2.7-tuxcare.1...

CLSA-2026-1777336754 TuxCare security update for fast-xml-parser (1 CVE)

TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.6-tuxcare.1...

CLSA-2026-1776818199 TuxCare security update for fast-xml-parser (4 CVEs)

TuxCare rebuilt fast-xml-parser to address 4 CVEs. Fixed in 4.5.3-tuxcare.2...

CLSA-2026-1774398086 TuxCare security update for fast-xml-parser (1 CVE)

TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.3-tuxcare.1...

CVE-2026-59728: XML Injection (aka Blind XPath Injection)

Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. Bot...

@bpmiq/mcp (>=1.0.0, <=2.3.0), @bpmiq/validator (>=1.0.0, <=2.3.0) +30 more potentially affected by CVE-2026-73569 via fast-xml-parser (>=5.9.3, <=5.10.0)

fast-xml-parser NPM version =5.9.3, =1.0.0, =1.0.0, =0.1.0, =1.18.42-test.0, =1.6.6, =0.24.0, =5.1.22, =5.1.22, =0.0.1, =0.0.1, =49.13.0, =50.0.0, =2.4.0, =2.4.2 and more Source cves: CVE-2026-73569 Source advisory: OSV:GHSA-8R6M-32JQ-JX6Q...