Repository navigation
Security: NaturalIntelligence/fast-xml-parser
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Repeated DOCTYPE declarations reset entity expansion limitsGHSA-8r6m-32jq-jx6q published
Jul 16, 2026 by amitguptagwlHigh -
XML Comment and CDATA Injection via Unescaped Delimiters in XMLBuilderGHSA-gh4j-gqv2-49f6 published
Apr 18, 2026 by amitguptagwlModerate -
Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parserGHSA-jp2q-39xq-3w4g published
Mar 19, 2026 by amitguptagwlModerate -
Numeric entity expansion bypasses all entity expansion limits (incomplete fix for CVE-2026-26278)GHSA-8gc5-j5rx-235r published
Mar 16, 2026 by amitguptagwlHigh -
stack overflow in XMLBuilder with preserveOrderGHSA-fj3w-jwp8-x2g3 published
Feb 25, 2026 by amitguptagwlLow -
DoS through entity expansion in DOCTYPE (no expansion limit)GHSA-jmr7-xgp7-cmfj published
Feb 14, 2026 by amitguptagwlHigh -
Entity encoding bypass via regex injection in DOCTYPE entity namesGHSA-m7jm-9gc2-mpf2 published
Feb 20, 2026 by amitguptagwlCritical -
RangeError DoS Numeric Entities BugGHSA-37qj-frw5-hhjh published
Jan 30, 2026 by amitguptagwlHigh -
ReDOS at currency parsing fast-xml-parserGHSA-mpg4-rc92-vx8v published
Jul 28, 2024 by amitguptagwlHigh -
npm audit failsGHSA-h42m-r6cm-rcmp published
Jun 22, 2023 by amitguptagwlLow