The fast-xml-parser library is susceptible to a denial of service vulnerability via XML entity expansion, which can freeze applications using the affected versions.

This vulnerability involves improper restriction of recursive entity references in DTDs (CWE-776). An unauthenticated attacker can submit a crafted XML payload that forces the parser into an unlimited entity expansion cycle, leading to high CPU consumption and application unavailability.

A successful exploitation of this vulnerability results in a denial of service, rendering the affected application unresponsive to legitimate user traffic. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to service availability and business continuity. Organizations relying on this library for XML processing may face operational disruption if attackers successfully trigger the resource exhaustion state.

Immediate Action: Update the fast-xml-parser dependency to version 4.5.4 or 5.3.6 to incorporate the necessary security patches.

Proactive Monitoring: Monitor application logs and CPU utilization metrics for spikes or anomalies associated with XML parsing requests, which may indicate attempted exploitation.

Compensating Controls: If an immediate update is not feasible, disable DOCTYPE parsing by setting the processEntities: false option within the library configuration to prevent the recursive expansion trigger.

Public Exploit Available: Unknown

Given the ease of triggering this vulnerability, it is imperative that development teams identify instances of fast-xml-parser within their software supply chain and apply the provided updates. Prioritize this remediation in any environment where XML input is accepted from untrusted sources to ensure continued system availability and resilience against resource exhaustion attacks.