fast-xml-parser vulnerabilities
Validate XML, Parse XML, Build XML without C/C++ based libraries
- Registry
- npm
- Latest
- 5.11.2
- License
- MIT
12 known advisories
The latest version, 5.11.2, is not affected by any of them. Projects on older versions may be.
npm install fast-xml-parser@5.11.2Security advisories for fast-xml-parser
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
- Affected
- >=5.9.3 <5.10.1
- Fixed in
- 5.10.1
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
- Affected
- <5.7.0
- Fixed in
- 5.7.0
Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser
- Affected
- >=4.0.0-beta.3 <4.5.5 · >=5.0.0 <5.5.7
- Fixed in
- 4.5.5, 5.5.7
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
- Affected
- >=5.0.0 <5.5.6 · >=4.0.0-beta.3 <4.5.5
- Fixed in
- 4.5.5, 5.5.6
fast-xml-parser has stack overflow in XMLBuilder with preserveOrder
- Affected
- >=5.0.0 <5.3.8 · >=4.0.0-beta.0 <4.5.4
- Fixed in
- 4.5.4, 5.3.8
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
- Affected
- >=5.0.0 <5.3.5 · >=4.1.3 <4.5.4
- Fixed in
- 4.5.4, 5.3.5
fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
- Affected
- >=4.1.3 <4.5.4 · >=5.0.0 <5.3.6
- Fixed in
- 4.5.4, 5.3.6
fast-xml-parser has RangeError DoS Numeric Entities Bug
- Affected
- >=5.0.9 <5.3.4
- Fixed in
- 5.3.4
fast-xml-parser vulnerable to ReDOS at currency parsing
- Affected
- >=4.3.5 <4.4.1
- Fixed in
- 4.4.1
fast-xml-parser regex vulnerability patch could be improved from a safety perspective
- Affected
- >=4.2.4 <4.2.5
- Fixed in
- 4.2.5
fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name
- Affected
- <4.1.2
- Fixed in
- 4.1.2
fast-xml-parser vulnerable to Regex Injection via Doctype Entities
- Affected
- >=4.1.3 <4.2.4
- Fixed in
- 4.2.4
Which of your client projects still run an old fast-xml-parser?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.