Attack Chain

1. An attacker crafts a malicious XML document containing multiple DOCTYPE declarations.
2. The crafted XML document is supplied as input to a system or application utilizing the vulnerable fast-xml-parser library (versions >= 5.9.3, < 5.10.1).
3. The fast-xml-parser library begins parsing the XML document.
4. Upon encountering each DOCTYPE declaration, the parser passes its entities to the @nodable/entities library, which calls addInputEntities().
5. The addInputEntities() function, when called multiple times, unexpectedly resets internal entity expansion counters (e.g., maxTotalExpansions, maxExpandedLength).
6. Due to the repeated resets, the attacker's crafted XML document can exceed the configured entity-expansion limits that would normally prevent resource exhaustion.
7. The parsing process consumes excessive CPU cycles and memory.
8. The host system experiences event-loop blocking, memory exhaustion, and eventually the application process terminates, resulting in a denial of service.

Impact

Successful exploitation of this vulnerability leads to a denial of service (DoS) condition on the affected system or application. An attacker can cause excessive CPU utilization, block the event loop, exhaust available memory, and force the termination of the parsing process or the entire application. This can lead to significant service disruptions, system instability, and potential data loss if the application cannot recover gracefully. While specific victim counts are not available, any organization using vulnerable versions of fast-xml-parser in their web applications, APIs, or backend services is susceptible to this attack, with potential impact on critical business operations.

Recommendation

• Update fast-xml-parser to version 5.10.1 or later to patch the vulnerability.
• Manually implement input validation to check for and reject XML documents containing multiple DOCTYPE declarations, especially if immediate patching is not possible.
• Ensure the processEntity flag in fast-xml-parser configurations is kept off (default behavior) to reduce exposure, though this is not a complete mitigation for this specific vulnerability.