Skip to content
OpenAdvisories

Package · npm

fast-xml-parser

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-41650

    fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

    fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from Java…

    NaturalIntelligence fast-xml-parser fast-xml-parser node-webfont Debian Ubuntu npm
  • Medium 5.9
    CVE-2026-33349

    fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation

    fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEnti…

    NaturalIntelligence fast-xml-parser fast-xml-parser node-webfont Debian Ubuntu npm
  • Medium 6.5
    CVE-2021-26920

    Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended

    In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of t…

    Apache Software Foundation Apache Druid fast-xml-parser org.apache.druid:druid-core npm Maven