Description
“fast-xml-parser” allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for DoS attacks.
Recommendation
Update the fast-xml-parser package to the latest compatible version. Followings are version details:
- Affected version(s): >= 4.1.3, < 4.2.4
- Patched version(s): 4.2.4
References
Could your website be exposed too?
SmartScanner can check your website for fast-xml-parser vulnerable to Regex Injection via Doctype Entities and gives you actionable findings to investigate.
Start a free scanRelated Issues
- fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names - CVE-2026-25896
- fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters - CVE-2026-41650
- fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name - CVE-2023-26920
- fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits - CVE-2026-73569
You might also like:
See something that needs correcting? Let us knowUpdated March 09, 2026