Description
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData() in OrderedObjParser.js calls readTagExp() for each less-than character in an unterminated stop-node body and repeatedly rescans the remaining input while looking for a closing greater-than character. An attacker who supplies XML containing many tag fragments without a later closing character can cause quadratic rescanning before parsing fails, blocking a Node.js event loop and causing CPU-exhaustion denial of service. This issue is fixed in version 5.12.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NaturalIntelligence | fast-xml-parser | < 5.12.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jitsucom-jitsu-console | 2.11.0-r43 | — |
| Wolfi rolling | langfuse-3 +1 | 3.227.1-r1 | — |
| Wolfi rolling | nextcloud-server-33 | 33.0.10-r8 | — |
| Wolfi rolling | opensearch-dashboards-3 | 3.9.0-r11 | — |
| Wolfi rolling | prism | 5.16.0-r25 | — |
| Wolfi rolling | saf +1 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | fast-xml-parser | < 5.12.0 | 5.12.0 | GHSA-474x-hrwr-fgx4 |