A critical denial of service vulnerability in the fast-xml-parser library, versions 5.0.9 through 5.3.3, allows unauthenticated attackers to crash applications by supplying malicious XML payloads.

The vulnerability is caused by improper input validation during the processing of numeric entities. When the parser encounters out-of-range entity code points, such as an excessively large numeric character reference, it throws an uncaught exception that results in an application crash for any process handling the input.

The primary impact is the loss of availability for services that rely on fast-xml-parser to process XML data. Because the vulnerability is exploitable by unauthenticated remote attackers, it poses a significant risk to the stability of web applications and backend services. The CVSS score of 7.5 reflects the high impact on service availability, despite the lack of direct data exfiltration or unauthorized execution.

Immediate Action: Update the fast-xml-parser dependency to version 5.3.4 or later immediately to incorporate the necessary exception handling fixes.

Proactive Monitoring: Monitor application logs for frequent crashes or unexpected termination patterns in XML-processing modules, which may indicate attempted exploitation.

Compensating Controls: Implement strict input validation at the edge or application layer to reject XML payloads containing unconventional or excessively long numeric entity references.

Public Exploit Available: Unknown

Given the ease of triggering this denial of service condition, organizations using the affected versions should prioritize patching as part of their next maintenance cycle. Failure to update may allow adversaries to disrupt critical business processes by simply sending malformed XML requests to exposed endpoints.