NaturalIntelligence fast-xml-parser vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20241
3. 20268

Newest CVEs

• CVE-2026-73569

  fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

  NaturalIntelligence · fast-xml-parser

  High8.7
• CVE-2026-41650

  fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

  NaturalIntelligence · fast-xml-parser

  Medium6.1
• CVE-2026-33349

  fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation

  NaturalIntelligence · fast-xml-parser

  Medium5.9
• CVE-2026-33036

  fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

  NaturalIntelligence · fast-xml-parser

  High7.5
• CVE-2026-27942

  fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

  NaturalIntelligence · fast-xml-parser

  Low2.7
• CVE-2026-25896

  fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

  NaturalIntelligence · fast-xml-parser

  Critical9.3
• CVE-2026-26278

  fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

  NaturalIntelligence · fast-xml-parser

  High7.5
• CVE-2026-25128

  fast-xml-parser has RangeError DoS Numeric Entities Bug

  NaturalIntelligence · fast-xml-parser

  High7.5
• CVE-2024-41818

  ReDOS at currency parsing fast-xml-parser

  NaturalIntelligence · fast-xml-parser

  High7.5
• CVE-2023-34104

  Regex Injection via Doctype Entities

  NaturalIntelligence · fast-xml-parser

  High7.5