---
id: GHSA-8r6m-32jq-jx6q
title: 'fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits'
summary: 'fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits'
severity: high
cwe:
  - CWE-776
vendor: fast-xml-parser
product: fast-xml-parser
ecosystem: npm
affected:
  - 'fast-xml-parser >= 5.9.3, < 5.10.1'
patched:
  - fast-xml-parser 5.10.1
published: '2026-07-21'
updated: '2026-07-21'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-8r6m-32jq-jx6q'
references:
  - url: >-
      https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q
  - url: >-
      https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f
  - url: >-
      https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1
  - url: 'https://github.com/advisories/GHSA-8r6m-32jq-jx6q'
tags:
  - ghsa
  - npm
ingestedAt: '2026-07-21T22:55:08.402Z'
---

## Overview

### Impact
`fast-xml-parser` processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to `@nodable/entities` through `addInputEntities()`.

`addInputEntities()` resets the entity expansion counters every time it is called. An attacker can therefore insert additional DOCTYPE declarations to repeatedly reset maxTotalExpansions and maxExpandedLength during one parse operation.

This allows a crafted XML document to exceed the configured entity-expansion limits and can cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination.

### Workarounds
- Manually check if multiple DOCTYPEs are not present in input contents
- Update to v5.10.1
- Keep `processEntity` flag off

## Affected packages

- `fast-xml-parser >= 5.9.3, < 5.10.1`

## Remediation

Upgrade to a patched release:

- `fast-xml-parser 5.10.1`