fast-xml-parser (npm)
Validate XML, Parse XML and Build XML rapidly without C/C++ based libraries and no callback.
Advisories
31
Latest version
5.11.2
Released Sep 29, 2026
License
MIT
OpenSSF Scorecard
8.6 / 10
How to fix
Upgrading to 5.10.1 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install fast-xml-parser@5.11.2yarn
yarn add fast-xml-parser@5.11.2pnpm
pnpm add fast-xml-parser@5.11.2Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-8r6m-32jq-jx6q fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits |
High EPSS 0.51% |
>= 5.9.3, < 5.10.1 | 5.10.1 |
| GHSA-8r6m-32jq-jx6q fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits |
High EPSS 0.51% |
>= 5.9.3, < 5.10.1 | 5.10.1 |
| GHSA-gh4j-gqv2-49f6 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters |
Medium EPSS 0.24% |
< 5.7.0 | 5.7.0 |
| GHSA-gh4j-gqv2-49f6 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters |
Medium EPSS 0.24% |
< 5.7.0 | 5.7.0 |
| GHSA-jp2q-39xq-3w4g Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser |
Medium EPSS 0.47% |
>= 5.0.0, < 5.5.7 | 5.5.7 |
| GHSA-jp2q-39xq-3w4g Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser |
Medium EPSS 0.47% |
>= 4.0.0-beta.3, < 4.5.5 | 4.5.5 |
| GHSA-jp2q-39xq-3w4g Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser |
Medium EPSS 0.47% |
>= 5.0.0, < 5.5.7 | 5.5.7 |
| GHSA-jp2q-39xq-3w4g Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser |
Medium EPSS 0.47% |
>= 4.0.0-beta.3, < 4.5.5 | 4.5.5 |
| GHSA-8gc5-j5rx-235r fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) |
High EPSS 0.60% |
>= 5.0.0, < 5.5.6 | 5.5.6 |
| GHSA-8gc5-j5rx-235r fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) |
High EPSS 0.60% |
>= 4.0.0-beta.3, < 4.5.5 | 4.5.5 |
| GHSA-8gc5-j5rx-235r fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) |
High EPSS 0.60% |
>= 5.0.0, < 5.5.6 | 5.5.6 |
| GHSA-8gc5-j5rx-235r fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) |
High EPSS 0.60% |
>= 4.0.0-beta.3, < 4.5.5 | 4.5.5 |
| GHSA-fj3w-jwp8-x2g3 fast-xml-parser has stack overflow in XMLBuilder with preserveOrder |
Low EPSS 0.54% |
>= 5.0.0, < 5.3.8 | 5.3.8 |
| GHSA-fj3w-jwp8-x2g3 fast-xml-parser has stack overflow in XMLBuilder with preserveOrder |
Low EPSS 0.54% |
>= 4.0.0-beta.0, < 4.5.4 | 4.5.4 |
| GHSA-fj3w-jwp8-x2g3 fast-xml-parser has stack overflow in XMLBuilder with preserveOrder |
Low EPSS 0.54% |
>= 5.0.0, < 5.3.8 | 5.3.8 |
| GHSA-fj3w-jwp8-x2g3 fast-xml-parser has stack overflow in XMLBuilder with preserveOrder |
Low EPSS 0.54% |
>= 4.0.0-beta.0, < 4.5.4 | 4.5.4 |
| GHSA-m7jm-9gc2-mpf2 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names |
Critical EPSS 0.53% |
>= 5.0.0, < 5.3.5 | 5.3.5 |
| GHSA-m7jm-9gc2-mpf2 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names |
Critical EPSS 0.53% |
>= 4.1.3, < 4.5.4 | 4.5.4 |
| GHSA-m7jm-9gc2-mpf2 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names |
Critical EPSS 0.53% |
>= 4.1.3, < 4.5.4 | 4.5.4 |
| GHSA-m7jm-9gc2-mpf2 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names |
Critical EPSS 0.53% |
>= 5.0.0, < 5.3.5 | 5.3.5 |
| GHSA-jmr7-xgp7-cmfj fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) |
High EPSS 0.94% |
>= 4.1.3, < 4.5.4 | 4.5.4 |
| GHSA-jmr7-xgp7-cmfj fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) |
High EPSS 0.94% |
>= 4.1.3, < 4.5.4 | 4.5.4 |
| GHSA-jmr7-xgp7-cmfj fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) |
High EPSS 0.94% |
>= 5.0.0, < 5.3.6 | 5.3.6 |
| GHSA-jmr7-xgp7-cmfj fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) |
High EPSS 0.94% |
>= 5.0.0, < 5.3.6 | 5.3.6 |
| GHSA-37qj-frw5-hhjh fast-xml-parser has RangeError DoS Numeric Entities Bug |
High EPSS 0.61% |
>= 5.0.9, <= 5.3.3 | No fix yet |
| GHSA-37qj-frw5-hhjh fast-xml-parser has RangeError DoS Numeric Entities Bug |
High EPSS 0.61% |
>= 5.0.9, < 5.3.4 | 5.3.4 |
| GHSA-mpg4-rc92-vx8v fast-xml-parser vulnerable to ReDOS at currency parsing |
High EPSS 0.83% |
>= 4.3.5, < 4.4.1 | 4.4.1 |
| GHSA-gpv5-7x3g-ghjv fast-xml-parser regex vulnerability patch could be improved from a safety perspective |
Low | >= 4.2.4, < 4.2.5 | 4.2.5 |
| GHSA-6w63-h3fj-q4vw fast-xml-parser vulnerable to Regex Injection via Doctype Entities |
High EPSS 1.13% |
>= 4.1.3, < 4.2.4 | 4.2.4 |
| GHSA-6w63-h3fj-q4vw fast-xml-parser vulnerable to Regex Injection via Doctype Entities |
High EPSS 1.13% |
>= 4.1.3, < 4.2.4 | 4.2.4 |
| GHSA-x3cc-x39p-42qx Druid ingestion system Authenticated users can read data from other sources than intended |
Medium EPSS 9.50% |
< 4.1.2 | 4.1.2 |
Source: git+https://github.com/NaturalIntelligence/fast-xml-parser.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor