fast-xml-parser vulnerabilities (npm)
13 vulnerabilities.
-
fast-xml-parsernpm fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits 8.7 High -
fast-xml-parsernpm fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters 6.1 Medium -
fast-xml-parsernpm fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation 5.9 Medium -
fast-xml-parsernpm fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) 7.5 High -
fast-xml-parsernpm fast-xml-parser has stack overflow in XMLBuilder with preserveOrder 2.7 Low -
fast-xml-parsernpm fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names 9.3 Critical -
fast-xml-parsernpm fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) 7.5 High -
fast-xml-parsernpm fast-xml-parser has RangeError DoS Numeric Entities Bug 7.5 High -
fast-xml-parsernpm ReDOS at currency parsing fast-xml-parser 7.5 High -
fast-xml-parsernpm fast-xml-parser regex vulnerability patch could be improved from a safety perspective No score -
fast-xml-parsernpm Regex Injection via Doctype Entities 7.5 High -
fast-xml-parsernpm fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name 6.5 Medium -
fast-xml-parsernpm Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended 6.5 Medium