Sign in
Deutsch English Español Polski
High

fast-xml-parser vulnerable to Regex Injection via Doctype Entities

  • Disclosed: 06.06.2023
  • Updated: 11.10.2026 10:22

Impact

"fast-xml-parser" allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for DoS attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time.

Patches

The problem has been resolved in v4.2.4

Workarounds

Avoid using DOCTYPE parsing by processEntities: false option.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package fast-xml-parser >= 4.1.3, < 4.2.4 4.2.4

References

CVSS score 7.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE)
CWE-1333, CWE-400
Platform
npm
Package
fast-xml-parser
Disclosed
06.06.2023
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-6w63-h3fj-q4vw - CC BY 4.0

Vulnerability history: fast-xml-parser

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (12) in the archive
Total entries
12
First → latest
08.2021 07.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 6
  • Medium 3
  • Low 2

Disclosures per year

Severity:
  1. fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
    High CVE-2026-73569 >= 5.9.3, < 5.10.1 5.10.1
  2. fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
    High · 7.5 CVE-2026-33036 >= 5.0.0, < 5.5.6, >= 4.0.0-beta.3, < 4.5.5 5.5.6, 4.5.5
  3. fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
    Critical · 9.3 CVE-2026-25896 >= 5.0.0, < 5.3.5, >= 4.1.3, < 4.5.4 5.3.5, 4.5.4
  4. fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
    High · 7.5 CVE-2026-26278 >= 4.1.3, < 4.5.4, >= 5.0.0, < 5.3.6 4.5.4, 5.3.6
  5. fast-xml-parser has RangeError DoS Numeric Entities Bug
    High · 7.5 CVE-2026-25128 >= 5.0.9, < 5.3.4 5.3.4
  6. fast-xml-parser vulnerable to ReDOS at currency parsing
    High · 7.5 CVE-2024-41818 >= 4.3.5, < 4.4.1 4.4.1
  7. fast-xml-parser vulnerable to Regex Injection via Doctype Entities this entry
    High · 7.5 CVE-2023-34104 >= 4.1.3, < 4.2.4 4.2.4

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.