fast-xml-parser vulnerable to Regex Injection via Doctype Entities
Published 6 Jun 2023 · Updated 9 Mar 2026
Affected package
- Affected
- >=4.1.3 <4.2.4
- Fixed in
- 4.2.4
npm install fast-xml-parser@4.2.4Details
Impact
"fast-xml-parser" allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for DoS attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time.
Patches
The problem has been resolved in v4.2.4
Workarounds
Avoid using DOCTYPE parsing by processEntities: false option.
Is GHSA-6w63-h3fj-q4vw in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected fast-xml-parser, and gives you the command that fixes it.
References
- Linkgithub.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-6w63-h3fj-q4vw
- Advisorynvd.nist.gov/vuln/detail/CVE-2023-34104
- Linkgithub.com/NaturalIntelligence/fast-xml-parser/commit/39b0e050bb909e8499478657f84a3076e39ce76c
- Linkgithub.com/NaturalIntelligence/fast-xml-parser/commit/a4bdced80369892ee413bf08e28b78795a2b0d5b
- Packagegithub.com/NaturalIntelligence/fast-xml-parser
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.