Affected: npm: fast-xml-parser

### Summary The XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application.

### Details There is a check in `DocTypeReader.js` that tries to prevent entity expansion attacks by rejecting entities that reference other entities (it looks for & inside entity values). This does stop classic “Billion Laughs” payloads.

However, it doesn’t stop a much simpler variant.

If you define one large entity that contains only raw text (no & characters) and then reference it many times, the parser will happily expand it every time. There is no limit on how large the expanded result can become, or how many replacements are allowed.

The problem is in `replaceEntitiesValue()` inside `OrderedObjParser.js`. It repeatedly runs `val.replace()` in a loop, without any checks on total output size or execution cost. As the entity grows or the number of references increases, parsing time explodes.

Relevant code:

`DocTypeReader.js` (lines 28–33): entity registration only checks for &

`OrderedObjParser.js` (lines 439–458): entity replacement loop with no limits

### PoC

```js const { XMLParser } = require('fast-xml-parser');

const entity = 'A'.repeat(1000); const refs = '&big;'.repeat(100); const xml = `<!DOCTYPE foo [<!ENTITY big "${entity}">]><root>${refs}</root>`;

console.time('parse'); new XMLParser().parse(xml); // ~4–8 se…