Is fast-xml-parser 2.9 vulnerable?

npm · 5 releases from 2.9.0 to 2.9.4 · latest fast-xml-parser is 5.11.2 · checked 2 Nov 2026

Yes: 2 known advisories

Yes. fast-xml-parser 2.9.4, the last 2.9 release, is affected by 2 known security advisories (2 medium), including CVE-2026-41650, CVE-2021-26920. Upgrade to 5.7.0 or later to fix all of them.

Upgrade with:npm install fast-xml-parser@5.7.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting fast-xml-parser 2.9.4

  • MediumCVE-2026-41650GHSA-gh4j-gqv2-49f622 Apr 2026

    fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

    Affected
    <5.7.0
    Fixed in
    5.7.0
  • MediumCVE-2021-26920GHSA-x3cc-x39p-42qx13 Jun 2023

    fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name

    Affected
    <4.1.2
    Fixed in
    4.1.2

Which of your client projects are still on fast-xml-parser 2.9?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact fast-xml-parser version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other fast-xml-parser versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.