Description
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NaturalIntelligence | fast-xml-parser | >= 5.0.0, < 5.3.6, >= 4.1.3, < 4.5.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-webfont | No fix yet | — |
| Debian 13 | node-webfont | No fix yet | — |
| Debian 12 | node-webfont | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-webfont | No fix yet | — |
| Ubuntu 26.04 LTS | node-webfont | No fix yet | — |
| Ubuntu 25.10 | node-webfont | No fix yet | — |
| Ubuntu 24.04 LTS | node-webfont | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | heroic-games-launcher | 2.20.0-1.1 | openSUSE-SU-2026:10236-1 |
| openSUSE Tumbleweed | velociraptor | 0.7.0.4.git185.a5708584-2.1 | openSUSE-SU-2026:11126-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jitsucom-jitsu-console | 2.11.0-r15 | — |
| Wolfi rolling | kubeflow-pipelines-frontend | 2.15.0-r12 | — |
| Wolfi rolling | prism | 5.14.3-r7 | — |
| Wolfi rolling | renovate | 43.48.3-r0 | — |
| Wolfi rolling | saf | 1.6.0-r0 | — |
| Wolfi rolling | tileserver-gl | 5.5.0-r5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | fast-xml-parser | >= 4.1.3, < 4.5.4 | 4.5.4 | GHSA-jmr7-xgp7-cmfj |
| npm | fast-xml-parser | >= 5.0.0, < 5.3.6 | 5.3.6 | GHSA-jmr7-xgp7-cmfj |
Advisories 5
- SCA-2026-0014 Fast-xml-parser vulnerabilities affect Sentio Creator Extension 'Device Manager' SICK PSIRT · Oct 14, 2026
- openSUSE-SU-2026:11126-1 velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media SUSE / openSUSE Security Updates · Jun 26, 2026
- WID-SEC-2026-1220 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 7, 2026
- WID-SEC-2026-0772 IBM App Connect Enterprise (fast-xml-parser): Mehrere Schwachstellen BSI CERT-Bund (WID) · May 21, 2026
- openSUSE-SU-2026:10236-1 heroic-games-launcher-2.20.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026