A flaw in the fast-xml-parser library allows an attacker to embed large numbers of numeric character references, such as A, in XML data. The parser mistakenly does not count these references against the configured expansion limits, thereby permitting the creation of hundreds of megabytes of memory allocation and consuming significant CPU cycles. The result is a resource exhaustion attack that can crash or slow down a Node.js application processing XML. The vulnerability is a classic instance of denial of service caused by unchecked data size and is classified under CWE‑776.

The issue affects the NaturalIntelligence fast‑xml‑parser package versions from 4.0.0‑beta.3 up through 5.5.5. Applications that import or use this library to parse XML—particularly those that do not have additional size checks—are exposed. The vendor’s repository and release notes indicate that the vulnerability was introduced in the 4.x line and remains until the 5.5.6 release.

The CVSS score is 7.5, indicating a high severity. However, the EPSS score of less than 1% suggests a low probability of exploitation in the near term, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote; an attacker can supply crafted XML to a vulnerable endpoint and trigger the memory and CPU blowup. Process crashes or severe slowdown on the target machine would be the primary outcomes if the application lacks additional safeguards. The advisory explicitly states the fix is available in v5.5.6, which fully enforces the expansion limits for numeric and standard entities.