# fast-xml-parser (npm) vulnerabilities 12 known vulnerabilities (1 critical, 6 high, 2 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 5.12.0 (Nov 3, 2026): no advisory affects it - Newest unaffected release: 5.12.0 (Nov 3, 2026), the latest release - Weekly downloads: 111.1M - Dependents: 14.6K - Releases: 202 since 1.0.0 (Jan 28, 2017) - Registry: https://www.npmjs.com/package/fast-xml-parser - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-73569: 5.9.3 to 5.10.0 (5.10.1 is outside it) - CVE-2026-41650: 1.0.0 to 5.6.0 (5.7.0 is outside it) - CVE-2026-33349: 4.0.0-beta.3 to 4.5.4 (4.5.5 is outside it); 5.0.0 to 5.5.6 (5.5.7 is outside it) - CVE-2026-33036: 4.0.0-beta.3 to 4.5.4 (4.5.5 is outside it); 5.0.0 to 5.5.5 (5.5.6 is outside it) - CVE-2026-27942: 4.0.0-beta.0 to 4.5.3 (4.5.4 is outside it); 5.0.0 to 5.3.7 (5.3.8 is outside it) - CVE-2026-25896: 4.1.3 to 4.5.3 (4.5.4 is outside it); 5.0.0 to 5.3.4 (5.3.5 is outside it) - CVE-2026-26278: 4.1.3 to 4.5.3 (4.5.4 is outside it); 5.0.0 to 5.3.5 (5.3.6 is outside it) - CVE-2026-25128: 5.0.9 to 5.3.3 (5.3.4 is outside it) - CVE-2024-41818: 4.3.5 to 4.4.0 (4.4.1 is outside it) - CVE-2023-26920: 1.0.0 to 4.1.1 (4.1.2 is outside it) - CVE-2023-34104: 4.1.3 to 4.2.3 (4.2.4 is outside it) - CVE-2021-26920: 1.0.0 to 4.1.1 (4.1.2 is outside it) ## Advisories (12) ### [CVE-2026-73569](https://cve.now/CVE-2026-73569): fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits - Severity: High 8.7 - Published: Aug 13, 2026 - Affected: from 5.9.3, fixed in 5.10.1. - Fixed in 5.10.1 (released Jul 16, 2026, 28 days before disclosure). - The latest release, 5.12.0, is not affected. - 2% of fast-xml-parser downloads last week were affected versions (2.6M). ### [CVE-2026-41650](https://cve.now/CVE-2026-41650): fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters - Severity: Medium 6.1 - Published: May 7, 2026 - Affected: fixed in 5.7.0. - Fixed in 5.7.0 (released Apr 17, 2026, 20 days before disclosure). - The latest release, 5.12.0, is not affected. - 46% of fast-xml-parser downloads last week were affected versions (59.7M). ### [CVE-2026-33349](https://cve.now/CVE-2026-33349): fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation - Severity: Medium 5.9 - Published: Mar 24, 2026 - Affected: from 4.0.0-beta.3, fixed in 4.5.5; from 5.0.0, fixed in 5.5.7. - Fixed in 4.5.5 (released Mar 22, 2026, 2 days before disclosure) and 5.5.7 (released Mar 19, 2026, 5 days before disclosure). - The latest release, 5.12.0, is not affected. - 35% of fast-xml-parser downloads last week were affected versions (45M). ### [CVE-2026-33036](https://cve.now/CVE-2026-33036): fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) - Severity: High 7.5 - Published: Mar 20, 2026 - Affected: from 5.0.0, fixed in 5.5.6; from 4.0.0-beta.3, fixed in 4.5.5. - Fixed in 4.5.5 (released Mar 22, 2026, 2 days after disclosure) and 5.5.6 (released Mar 16, 2026, 4 days before disclosure). - The latest release, 5.12.0, is not affected. - 34% of fast-xml-parser downloads last week were affected versions (44.2M). ### [CVE-2026-27942](https://cve.now/CVE-2026-27942): fast-xml-parser has stack overflow in XMLBuilder with preserveOrder - Severity: Low 2.7 - Published: Feb 26, 2026 - Affected: from 5.0.0, fixed in 5.3.8; from 4.0.0-beta.0, fixed in 4.5.4. - Fixed in 4.5.4 (released Feb 26, 2026, the day of disclosure) and 5.3.8 (released Feb 25, 2026, 1 day before disclosure). - The latest release, 5.12.0, is not affected. - 32% of fast-xml-parser downloads last week were affected versions (41.5M). ### [CVE-2026-25896](https://cve.now/CVE-2026-25896): fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names - Severity: Critical 9.3 - Published: Feb 20, 2026 - Affected: from 5.0.0, fixed in 5.3.5; from 4.1.3, fixed in 4.5.4. - Fixed in 4.5.4 (released Feb 26, 2026, 6 days after disclosure) and 5.3.5 (released Feb 8, 2026, 12 days before disclosure). - The latest release, 5.12.0, is not affected. - 30% of fast-xml-parser downloads last week were affected versions (38.7M). ### [CVE-2026-26278](https://cve.now/CVE-2026-26278): fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) - Severity: High 7.5 - Published: Feb 19, 2026 - Affected: from 4.1.3, fixed in 4.5.4; from 5.0.0, fixed in 5.3.6. - Fixed in 4.5.4 (released Feb 26, 2026, 7 days after disclosure) and 5.3.6 (released Feb 14, 2026, 5 days before disclosure). - The latest release, 5.12.0, is not affected. - 30% of fast-xml-parser downloads last week were affected versions (39.2M). ### [CVE-2026-25128](https://cve.now/CVE-2026-25128): fast-xml-parser has RangeError DoS Numeric Entities Bug - Severity: High 7.5 - Published: Jan 30, 2026 - Affected: from 5.0.9, fixed in 5.3.4. - Fixed in 5.3.4 (released Jan 30, 2026, the day of disclosure). - The latest release, 5.12.0, is not affected. - 10% of fast-xml-parser downloads last week were affected versions (13.3M). ### [CVE-2024-41818](https://cve.now/CVE-2024-41818): ReDOS at currency parsing fast-xml-parser - Severity: High 7.5 - Published: Jul 29, 2024 - Affected: from 4.3.5, fixed in 4.4.1. - Fixed in 4.4.1 (released Jul 28, 2024, 1 day before disclosure). - The latest release, 5.12.0, is not affected. - 0.3% of fast-xml-parser downloads last week were affected versions (413.5K). ### [CVE-2023-26920](https://cve.now/CVE-2023-26920): fast-xml-parser before 4.1.2 allows proto for Prototype Pollution. - Severity: Unrated - Published: Dec 12, 2023 - Affected: fixed in 4.1.2. - Fixed in 4.1.2 (released Feb 12, 2023, 303 days before disclosure). - The latest release, 5.12.0, is not affected. - 2% of fast-xml-parser downloads last week were affected versions (2.6M). ### [CVE-2023-34104](https://cve.now/CVE-2023-34104): Regex Injection via Doctype Entities - Severity: High 7.5 - Published: Jun 6, 2023 - Affected: from 4.1.3, fixed in 4.2.4. - Fixed in 4.2.4 (released Jun 6, 2023, the day of disclosure). - The latest release, 5.12.0, is not affected. - <0.1% of fast-xml-parser downloads last week were affected versions (70.6K). ### [CVE-2021-26920](https://cve.now/CVE-2021-26920): Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended - Severity: Unrated - Published: Jul 2, 2021 - Affected: fixed in 4.1.2. - Fixed in 4.1.2 (released Feb 12, 2023, 590 days after disclosure). - The latest release, 5.12.0, is not affected. - 2% of fast-xml-parser downloads last week were affected versions (2.6M). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/fast-xml-parser Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.