fast-xml-parser vulnerabilities (Root)
8 vulnerabilities.
-
fast-xml-parserRoot fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters 6.1 Medium -
fast-xml-parserRoot fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation 5.9 Medium -
fast-xml-parserRoot fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) 7.5 High -
fast-xml-parserRoot fast-xml-parser has stack overflow in XMLBuilder with preserveOrder 2.7 Low -
fast-xml-parserRoot fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names 9.3 Critical -
fast-xml-parserRoot fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) 7.5 High -
fast-xml-parserRoot fast-xml-parser has RangeError DoS Numeric Entities Bug 7.5 High -
fast-xml-parserRoot fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name 6.5 Medium