A vulnerability in the NaturalIntelligence fast-xml-parser library allows unauthenticated attackers to cause a Denial of Service through resource exhaustion, necessitating an immediate update to version 5.5.6 or 4.5.5.

The library fails to properly enforce entity expansion limits for numeric and standard XML entities in the OrderedObjParser.js component. This allows an unauthenticated attacker to bypass security configurations and force excessive memory and CPU consumption, resulting in a Denial of Service.

The exploitation of this vulnerability can lead to significant system instability and service downtime for any application relying on the fast-xml-parser library to process user-supplied XML. Given the CVSS score of 7.5, the risk is considered High, as the flaw is remotely exploitable without authentication, potentially impacting the availability of critical business services.

Immediate Action: Update the fast-xml-parser package to version 5.5.6 or 4.5.5 immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor server CPU and memory utilization patterns for spikes that correlate with XML processing tasks, which may indicate attempted exploitation.

Compensating Controls: Implement strict input validation or size limits on incoming XML payloads at the network edge or application gateway to reduce the feasibility of large-scale entity expansion attacks.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability presents a clear risk to service availability by circumventing established security limits. Organizations utilizing fast-xml-parser must prioritize the deployment of the provided patches to ensure that entity expansion limits are correctly enforced and to prevent resource exhaustion attacks.