Description
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `�` or `�`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NaturalIntelligence | fast-xml-parser | >= 5.0.9, <= 5.3.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-webfont | No fix yet | — |
| Ubuntu 26.04 LTS | node-webfont | No fix yet | — |
| Ubuntu 25.10 | node-webfont | No fix yet | — |
| Ubuntu 24.04 LTS | node-webfont | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | velociraptor | 0.7.0.4.git185.a5708584-2.1 | openSUSE-SU-2026:11126-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jitsucom-jitsu-console | 2.11.0-r14 | — |
| Wolfi rolling | kubeflow-pipelines-frontend | 2.15.0-r7 | — |
| Wolfi rolling | langfuse-3 +1 | 3.150.0-r0 | — |
| Wolfi rolling | opensearch-dashboards-3 | 3.4.0-r2 | — |
| Wolfi rolling | prism | 5.14.3-r5 | — |
| Wolfi rolling | renovate | 43.3.1-r0 | — |
| Wolfi rolling | saf | 1.5.3-r1 | — |
| Wolfi rolling | tileserver-gl | 5.5.0-r4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | fast-xml-parser | >= 5.0.9, < 5.3.4 | 5.3.4 | GHSA-37qj-frw5-hhjh |
Advisories 3
- openSUSE-SU-2026:11126-1 velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media SUSE / openSUSE Security Updates · Jun 26, 2026
- WID-SEC-2026-0526 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 7, 2026
- WID-SEC-2026-1039 IBM DataPower Gateway: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Apr 9, 2026