The vulnerability allows multiple DOCTYPE declarations in a single XML document to repeatedly reset the parser’s entity‑expansion limits. When a crafted XML payload is processed, the parser consumes additional CPU cycles, blocks the event loop, exhausts memory, and ultimately terminates the process, which can bring an application to a halt. The danger is that an attacker who can supply XML to the parser can directly trigger a denial of service.

Applications that depend on NaturalIntelligence fast-xml-parser versions 5.9.3 through 5.10.1 are vulnerable. Versions prior to 5.9.3 and 5.10.1 or later are not affected because the issue was addressed in release 5.10.1.

The CVSS score of 8.7 classifies this flaw as a high‑severity denial‑of‑service vulnerability. The EPSS score is not available and the flaw is not listed in CISA KEV, indicating no known public exploits to date. The likely attack vector is remote: an attacker can send a specially crafted XML document to an application that accepts untrusted XML data, immediately depleting system resources and causing an outage. Due to the high impact and the potential for broad exposure, the risk is significant for any product that processes XML input using this library without additional safeguards.