npmPackage

fast-xml-parser

12 known vulnerabilities (1 critical, 6 high, 2 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: 5.12.0 (Nov 3, 2026): no advisory affects it
Newest unaffected release: 5.12.0 (Nov 3, 2026), the latest release
Advisories: 12 · 1 critical, 6 high, 2 medium, 1 low

Weekly downloads: 111.1M
Dependents: 14.6K
Releases: 202 since 1.0.0 (Jan 28, 2017)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-73569
Affects 5.9.3 to 5.10.0 (5.10.1 is outside it)
CVE-2026-41650
Affects 1.0.0 to 5.6.0 (5.7.0 is outside it)
CVE-2026-33349
Affects 4.0.0-beta.3 to 4.5.4 (4.5.5 is outside it); 5.0.0 to 5.5.6 (5.5.7 is outside it)
CVE-2026-33036
Affects 4.0.0-beta.3 to 4.5.4 (4.5.5 is outside it); 5.0.0 to 5.5.5 (5.5.6 is outside it)
CVE-2026-27942
Affects 4.0.0-beta.0 to 4.5.3 (4.5.4 is outside it); 5.0.0 to 5.3.7 (5.3.8 is outside it)
CVE-2026-25896
Affects 4.1.3 to 4.5.3 (4.5.4 is outside it); 5.0.0 to 5.3.4 (5.3.5 is outside it)
CVE-2026-26278
Affects 4.1.3 to 4.5.3 (4.5.4 is outside it); 5.0.0 to 5.3.5 (5.3.6 is outside it)
CVE-2026-25128
Affects 5.0.9 to 5.3.3 (5.3.4 is outside it)
CVE-2024-41818
Affects 4.3.5 to 4.4.0 (4.4.1 is outside it)
CVE-2023-26920
Affects 1.0.0 to 4.1.1 (4.1.2 is outside it)
CVE-2023-34104
Affects 4.1.3 to 4.2.3 (4.2.4 is outside it)
CVE-2021-26920
Affects 1.0.0 to 4.1.1 (4.1.2 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 12

CVE-2026-73569High 8.7
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
Affected: from 5.9.3, fixed in 5.10.1.
Fixed in 5.10.1 (released Jul 16, 2026, 28 days before disclosure).
The latest release, 5.12.0, is not affected.
2% of fast-xml-parser downloads last week were affected versions (2.6M).
CVE-2026-41650Medium 6.1
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
Affected: fixed in 5.7.0.
Fixed in 5.7.0 (released Apr 17, 2026, 20 days before disclosure).
The latest release, 5.12.0, is not affected.
46% of fast-xml-parser downloads last week were affected versions (59.7M).
CVE-2026-33349Medium 5.9
fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation
Affected: from 4.0.0-beta.3, fixed in 4.5.5; from 5.0.0, fixed in 5.5.7.
Fixed in 4.5.5 (released Mar 22, 2026, 2 days before disclosure) and 5.5.7 (released Mar 19, 2026, 5 days before disclosure).
The latest release, 5.12.0, is not affected.
35% of fast-xml-parser downloads last week were affected versions (45M).
CVE-2026-33036High 7.5
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
Affected: from 5.0.0, fixed in 5.5.6; from 4.0.0-beta.3, fixed in 4.5.5.
Fixed in 4.5.5 (released Mar 22, 2026, 2 days after disclosure) and 5.5.6 (released Mar 16, 2026, 4 days before disclosure).
The latest release, 5.12.0, is not affected.
34% of fast-xml-parser downloads last week were affected versions (44.2M).
CVE-2026-27942Low 2.7
fast-xml-parser has stack overflow in XMLBuilder with preserveOrder
Affected: from 5.0.0, fixed in 5.3.8; from 4.0.0-beta.0, fixed in 4.5.4.
Fixed in 4.5.4 (released Feb 26, 2026, the day of disclosure) and 5.3.8 (released Feb 25, 2026, 1 day before disclosure).
The latest release, 5.12.0, is not affected.
32% of fast-xml-parser downloads last week were affected versions (41.5M).
CVE-2026-25896Critical 9.3
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
Affected: from 5.0.0, fixed in 5.3.5; from 4.1.3, fixed in 4.5.4.
Fixed in 4.5.4 (released Feb 26, 2026, 6 days after disclosure) and 5.3.5 (released Feb 8, 2026, 12 days before disclosure).
The latest release, 5.12.0, is not affected.
30% of fast-xml-parser downloads last week were affected versions (38.7M).
CVE-2026-26278High 7.5
fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
Affected: from 4.1.3, fixed in 4.5.4; from 5.0.0, fixed in 5.3.6.
Fixed in 4.5.4 (released Feb 26, 2026, 7 days after disclosure) and 5.3.6 (released Feb 14, 2026, 5 days before disclosure).
The latest release, 5.12.0, is not affected.
30% of fast-xml-parser downloads last week were affected versions (39.2M).
CVE-2026-25128High 7.5
fast-xml-parser has RangeError DoS Numeric Entities Bug
Affected: from 5.0.9, fixed in 5.3.4.
Fixed in 5.3.4 (released Jan 30, 2026, the day of disclosure).
The latest release, 5.12.0, is not affected.
10% of fast-xml-parser downloads last week were affected versions (13.3M).
CVE-2024-41818High 7.5
ReDOS at currency parsing fast-xml-parser
Affected: from 4.3.5, fixed in 4.4.1.
Fixed in 4.4.1 (released Jul 28, 2024, 1 day before disclosure).
The latest release, 5.12.0, is not affected.
0.3% of fast-xml-parser downloads last week were affected versions (413.5K).
CVE-2023-26920Unrated
fast-xml-parser before 4.1.2 allows proto for Prototype Pollution.
Affected: fixed in 4.1.2.
Fixed in 4.1.2 (released Feb 12, 2023, 303 days before disclosure).
The latest release, 5.12.0, is not affected.
2% of fast-xml-parser downloads last week were affected versions (2.6M).
CVE-2023-34104High 7.5
Regex Injection via Doctype Entities
Affected: from 4.1.3, fixed in 4.2.4.
Fixed in 4.2.4 (released Jun 6, 2023, the day of disclosure).
The latest release, 5.12.0, is not affected.
<0.1% of fast-xml-parser downloads last week were affected versions (70.6K).
CVE-2021-26920Unrated
Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended
Affected: fixed in 4.1.2.
Fixed in 4.1.2 (released Feb 12, 2023, 590 days after disclosure).
The latest release, 5.12.0, is not affected.
2% of fast-xml-parser downloads last week were affected versions (2.6M).