fast-xml-parser versions 5.0.9 through 5.3.3 contain a numeric entity processing flaw that causes a RangeError when the parser encounters an out‑of‑range code point such as � or �. This exception is not caught by the library, leading to an uncaught crash of any application that uses the parser on untrusted XML input. The resulting failure of the application is limited to denial of service and does not provide the attacker with further code execution or privilege escalation.

The vulnerability affects the NaturalIntelligence fast‑xml‑parser package for Node.js. All releases from 5.0.9 up to and including 5.3.3 are impacted; the issue was fixed in release 5.3.4 and later versions are considered safe.

The CVSS score of 7.5 indicates a high severity attack. The EPSS score of less than 1% signals a very low probability of exploitation at the time of this analysis, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that an attacker can submit crafted XML data – either via an API endpoint, file upload, or configuration file – that contains malformed numeric entities. Upon parsing, the application will throw an uncaught RangeError and terminate, resulting in a denial of service. Because the flaw is triggered by untrusted input, it is feasible for remote exploitation in applications that expose XML data processing services.