CVE-2026-73569

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.

• CWE-776

• https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f
• https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1
• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q

Published

Aug 13, 2026

Last Modified

Aug 13, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73563Backstage is an open framework for building developer portal…4.7
• CVE-2026-73564frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's…8.7
• CVE-2026-73565@hono/node-server allows running the Hono application on Nod…5.3
• CVE-2026-73566node-tar is a tar archive manipulation library for Node.js. …7.5
• CVE-2026-73567sm-crypto provides JavaScript implementations of the Chinese…9.1
• CVE-2026-73568py-libp2p is the Python implementation of the libp2p network…7.5
• CVE-2026-7357Use after free in GPU in Google Chrome prior to 147.0.7727.1…7.5
• CVE-2026-73570A remote code execution vulnerability exists in Zimbra Colla…8.9
• CVE-2026-73571An authorization bypass vulnerability exists in Zimbra Colla…3.1
• CVE-2026-73572In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross…6.1
• CVE-2026-73573In Zimbra Collaboration (ZCS) before 10.1.17, a path travers…3.1
• CVE-2026-73574In Zimbra Collaboration before 10.1.17, a local file inclusi…3.1