Skip to content
OpenAdvisories

Package · Debian

node-webfont

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-41650

    fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

    fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from Java…

    NaturalIntelligence fast-xml-parser fast-xml-parser node-webfont Debian Ubuntu npm
  • Medium 5.9
    CVE-2026-33349

    fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation

    fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEnti…

    NaturalIntelligence fast-xml-parser fast-xml-parser node-webfont Debian Ubuntu npm