Naturalintelligence Fast-xml-parser vulnerabilities

• naturalintelligence fast-xml-parser fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits CVE-2026-73569 Fix available 8.7 HighJuly 21, 2026
• naturalintelligence fast-xml-parser fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters CVE-2026-41650 Fix available 6.1 MediumApril 22, 2026
• naturalintelligence fast-xml-parser fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation CVE-2026-33349 Fix available 5.9 MediumMarch 19, 2026
• naturalintelligence fast-xml-parser fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) CVE-2026-33036 Fix available 7.5 HighMarch 17, 2026
• naturalintelligence fast-xml-parser fast-xml-parser has stack overflow in XMLBuilder with preserveOrder CVE-2026-27942 Fix available 2.7 LowFebruary 26, 2026
• naturalintelligence fast-xml-parser, red hat migration toolkit for applications 8, advanced cluster security 4.8 +11 more +13 more fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names CVE-2026-25896 Fix available 9.3 CriticalFebruary 20, 2026
• naturalintelligence fast-xml-parser, red hat migration toolkit for applications 8, advanced cluster security 4.8 +11 more +13 more fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) CVE-2026-26278 Fix available 7.5 HighFebruary 17, 2026
• naturalintelligence fast-xml-parser fast-xml-parser has RangeError DoS Numeric Entities Bug CVE-2026-25128 Fix available 7.5 HighJanuary 30, 2026
• naturalintelligence fast-xml-parser, fast xml parser +1 more ReDOS at currency parsing fast-xml-parser CVE-2024-41818 Fix available 7.5 HighJuly 29, 2024
• naturalintelligence fast-xml-parser Regex Injection via Doctype Entities CVE-2023-34104 Fix available 7.5 HighJune 6, 2023