Description
No description available.
Recommendation
Update the fast-xml-parser package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.1.3, < 4.5.4 >= 5.0.0, < 5.3.5** Patched version(s): **4.5.4 5.3.5**
References
Could your website be exposed too?
SmartScanner can check your website for fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names and gives you actionable findings to investigate.
Start a free scanRelated Issues
- fast-xml-parser vulnerable to Regex Injection via Doctype Entities - CVE-2023-34104
- fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters - CVE-2026-41650
- fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) - CVE-2026-26278
- fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits - CVE-2026-73569
You might also like:
See something that needs correcting? Let us knowUpdated February 27, 2026