npm/fast-xml-parser

fast-xml-parser has RangeError DoS Numeric Entities Bug

Modified: 9/10/2026

fast-xml-parser vulnerable to Regex Injection via Doctype Entities

Modified: 3/9/2026

fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

Modified: 9/10/2026

fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

Modified: 9/10/2026

fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

Modified: 9/10/2026

fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

Modified: 9/10/2026

fast-xml-parser regex vulnerability patch could be improved from a safety perspective

Modified: 6/15/2023

fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

Modified: 9/10/2026

Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser

Modified: 9/10/2026

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

Modified: 9/10/2026

fast-xml-parser vulnerable to ReDOS at currency parsing

Modified: 9/10/2026

fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name

Modified: 7/8/2026