naturalintelligence/fast-xml-parser Security Advisories | GitStock

high2026-07-21

fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

GHSA-8r6m-32jq-jx6q · CVE-2026-73569

medium2026-04-22

fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

GHSA-gh4j-gqv2-49f6 · CVE-2026-41650

medium2026-03-19

Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser

GHSA-jp2q-39xq-3w4g · CVE-2026-33349

high2026-03-17

fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

GHSA-8gc5-j5rx-235r · CVE-2026-33036

low2026-02-26

fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

GHSA-fj3w-jwp8-x2g3 · CVE-2026-27942

critical2026-02-20

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

GHSA-m7jm-9gc2-mpf2 · CVE-2026-25896

high2026-02-17

fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

GHSA-jmr7-xgp7-cmfj · CVE-2026-26278

high2026-01-30

fast-xml-parser has RangeError DoS Numeric Entities Bug

GHSA-37qj-frw5-hhjh · CVE-2026-25128

high2024-07-29

fast-xml-parser vulnerable to ReDOS at currency parsing

GHSA-mpg4-rc92-vx8v · CVE-2024-41818

low2023-06-15

fast-xml-parser regex vulnerability patch could be improved from a safety perspective

GHSA-gpv5-7x3g-ghjv

medium2023-06-13

fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name

GHSA-x3cc-x39p-42qx · CVE-2023-26920

high2023-06-06

fast-xml-parser vulnerable to Regex Injection via Doctype Entities

GHSA-6w63-h3fj-q4vw · CVE-2023-34104