CVE-2023-34104
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
fast-xml-parser is an open source, pure JavaScript XML parser that allows special characters in entity names, which are not properly escaped. An attacker can exploit this vulnerability to perform denial of service (DoS) attacks by crafting entity names that generate inefficient regular expressions.
Risk Assessment
This vulnerability can cause the parser to stall indefinitely, impacting the availability of applications using this component. Organizations should be aware of the risks associated with using this library in critical systems.
Recommendation
It is recommended to upgrade to version 4.2.4 or later to mitigate this vulnerability. Users unable to upgrade should avoid using DOCTYPE parsing by setting the `processEntities: false` option.
Other vulnerabilities in fast-xml-parser
See all- CVE-2026-25896Critical
In fast-xml-parser versions 4.1.3 through before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered.
- CVE-2026-73569High
fast-xml-parser versions 5.9.3 through 5.10.1 have a vulnerability related to processing multiple DOCTYPE declarations in a single XML document. The addInputEntities() function resets entity expansion limits on each call, allowing bypass of protections and potentially causing excessive CPU usage, event-loop blocking, memory exhaustion, and process termination. The issue is fixed in version 5.10.1.
- CVE-2026-26278High
A vulnerability in the fast-xml-parser library allows a DoS attack via unlimited entity expansion. Even a small XML file can cause prolonged processing and freeze the application.
Original NVD description (English source)
fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denial of service (DoS) attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time. This problem has been resolved in v4.2.4. Users are advised to upgrade. Users unable to upgrade should avoid using DOCTYPE parsing by setting the `processEntities: false` option.