HighGHSA-mpg4-rc92-vx8vCVE-2024-41818
fast-xml-parser vulnerable to ReDOS at currency parsing
Published 29 Jul 2024 · Updated 10 Sept 2026
Affected package
- Affected
- >=4.3.5 <4.4.1
- Fixed in
- 4.4.1
Update to the fixed version for your release line, for example:
npm install fast-xml-parser@4.4.1Details
Summary
A ReDOS that exists on currency.js was discovered by Gauss Security Labs R&D team.
Details
https://github.com/NaturalIntelligence/fast-xml-parser/blob/v4.4.0/src/v5/valueParsers/currency.js#L10 contains a vulnerable regex
PoC
pass the following string '\t'.repeat(13337) + '.'
Impact
Denial of service during currency parsing in experimental version 5 of fast-xml-parser-library
https://gauss-security.com
Is GHSA-mpg4-rc92-vx8v in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected fast-xml-parser, and gives you the command that fixes it.
References
- Linkgithub.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-mpg4-rc92-vx8v
- Advisorynvd.nist.gov/vuln/detail/CVE-2024-41818
- Linkgithub.com/NaturalIntelligence/fast-xml-parser/commit/ba5f35e7680468acd7906eaabb2f69e28ed8b2aa
- Linkgithub.com/NaturalIntelligence/fast-xml-parser/commit/d0bfe8a3a2813a185f39591bbef222212d856164
- Packagegithub.com/NaturalIntelligence/fast-xml-parser
- Linkgithub.com/NaturalIntelligence/fast-xml-parser/blob/master/src/v5/valueParsers/currency.js#L10
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.