node-webfont vulnerabilities (Debian)
8 vulnerabilities.
-
node-webfontDebian fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits 8.7 High -
node-webfontDebian fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters 6.1 Medium -
node-webfontDebian fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation 5.9 Medium -
node-webfontDebian fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) 7.5 High -
node-webfontDebian fast-xml-parser has stack overflow in XMLBuilder with preserveOrder 2.7 Low -
node-webfontDebian fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names 9.3 Critical -
node-webfontDebian fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) 7.5 High -
node-webfontDebian fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name 6.5 Medium