The vulnerability in the XML parsing library enables attackers to cause unbounded entity expansion. When developers set the entity limit values to zero, JavaScript treats the values as falsy and bypasses the intended checks. This allows malicious XML input to grow without bound, exhaust memory resources, and result in a denial of service for the affected application.

Applications that rely on NaturalIntelligence's fast-xml-parser, version 4.0.0-beta.3 through the release before 5.5.7, are impacted by this flaw. The issue affects all releases in the stated range regardless of the platform, as the vulnerability exists within the JavaScript implementation of the library.

The flaw carries a CVSS score of 5.9, indicating a medium severity rating, and an EPSS score of less than 1%, suggesting a low probability of exploitation. It is not included in the CISA Known Exploited Vulnerabilities catalog. Attackers who can provide XML input to an application using the vulnerable library may trigger the memory exhaustion and achieve a denial of service. The exploit requires the application to parse external XML data, which may be supplied over the network or locally within the environment.