Is fast-xml-parser 5.6 vulnerable?

npm · 1 release from 5.6.0 to 5.6.0 · latest fast-xml-parser is 5.11.2 · checked 1 Nov 2026

Yes: 1 known advisory

Yes. fast-xml-parser 5.6.0, the last 5.6 release, is affected by 1 known security advisory (1 medium), including CVE-2026-41650. Upgrade to 5.7.0 or later to fix all of them.

Upgrade with:npm install fast-xml-parser@5.7.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting fast-xml-parser 5.6.0

  • MediumCVE-2026-41650GHSA-gh4j-gqv2-49f622 Apr 2026

    fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

    Affected
    <5.7.0
    Fixed in
    5.7.0

Which of your client projects are still on fast-xml-parser 5.6?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact fast-xml-parser version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other fast-xml-parser versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.