What’s Vulnerable › Products

NaturalIntelligence fast-xml-parser vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your NaturalIntelligence fast-xml-parser version is affected

Latest NaturalIntelligence fast-xml-parser vulnerabilities

• CVE-2026-73569 — fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits (CVSS 8.7)
• CVE-2026-41650 — fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters (CVSS 6.1)
• CVE-2026-33349 — fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation (CVSS 5.9)
• CVE-2026-33036 — fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) (CVSS 7.5)
• CVE-2026-27942 — fast-xml-parser has stack overflow in XMLBuilder with preserveOrder (CVSS 7.5)
• CVE-2026-25896 — fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names (CVSS 9.3)
• CVE-2026-26278 — fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) (CVSS 7.5)
• CVE-2026-25128 — fast-xml-parser has RangeError DoS Numeric Entities Bug (CVSS 7.5)
• CVE-2024-41818 — ReDOS at currency parsing fast-xml-parser (CVSS 7.5)
• CVE-2023-34104 — Regex Injection via Doctype Entities (CVSS 7.5)