Description
This is a comment on https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-6w63-h3fj-q4vw and the patches fixing it.
Recommendation
Update the fast-xml-parser package to the latest compatible version. Followings are version details:
- Affected version(s): = 4.2.4
- Patched version(s): 4.2.5
References
Could your website be exposed too?
SmartScanner can check your website for fast-xml-parser regex vulnerability patch could be improved from a safety perspective and gives you actionable findings to investigate.
Start a free scanRelated Issues
- fast-xml-parser vulnerable to Regex Injection via Doctype Entities - CVE-2023-34104
- fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names - CVE-2026-25896
- fast-xml-parser has RangeError DoS Numeric Entities Bug - CVE-2026-25128
- fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026- - CVE-2026-33036
You might also like:
See something that needs correcting? Let us knowUpdated November 29, 2023