A high-severity XML entity expansion vulnerability in the fast-xml-parser library poses a significant risk of denial-of-service attacks.

This vulnerability, classified as CWE-776, involves the improper restriction of recursive entity references in DTDs. It allows an unauthenticated attacker to supply malicious XML payloads to the parser, leading to excessive resource consumption.

Successful exploitation results in service unavailability, as the parser consumes excessive memory or CPU cycles while processing the recursive entities. With a CVSS score of 8.7, the impact on availability is critical for applications relying on this library for data processing. This could lead to significant operational disruptions for dependent services.

Immediate Action: Update the npm package fast-xml-parser to version 5.10.1 or later to implement the necessary security patches.

Proactive Monitoring: Monitor application logs for unusual XML processing patterns or sudden spikes in memory usage that may indicate attempts to trigger entity expansion.

Compensating Controls: If immediate patching is not feasible, implement strict XML schema validation to reject documents containing DTDs or external entity references before they reach the parser.

Public Exploit Available: No (exploit_available unknown).

Given the high CVSS score and the ease of exploitation, teams should prioritize upgrading to version 5.10.1. Failure to address this vulnerability leaves critical data processing pipelines exposed to potential service outages.