207 matches found
ROOT-APP-NPM-CVE-2026-26278 CVE-2026-26278 in fast-xml-parser - Patched by Root
Root has patched CVE-2026-26278 in the fast-xml-parser package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-33036 CVE-2026-33036 in fast-xml-parser - Patched by Root
Root has patched CVE-2026-33036 in the fast-xml-parser package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-25896 CVE-2026-25896 in fast-xml-parser - Patched by Root
Root has patched CVE-2026-25896 in the fast-xml-parser package for Root:npm. Multiple fixed versions available...
Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Improper Input Validation.
Summary fast-xml-parser is used by IBM Storage Fusion Data Foundation, which could cause Improper Input Validation. CVE-2026-25896. Vulnerability Details CVEID:CVE-2026-25896 DESCRIPTION: fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C...
CVE-2026-73569
A flaw was found in fast-xml-parser. A remote attacker could exploit this by submitting a specially crafted XML document containing multiple DOCTYPE declarations. These repeated declarations can reset internal entity expansion limits during parsing. This can lead to excessive CPU usage, event-loo...
Linux Distros Unpatched Vulnerability : CVE-2026-73569
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.j...
DEBIAN-CVE-2026-73569
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...
CVE-2026-73569
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...
UBUNTU-CVE-2026-73569
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...
CVE-2026-73569 fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...
CVE-2026-73569 fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...
CVE-2026-73569
CVE-2026-73569 affects fast-xml-parser (OrderedObjParser.js). When parsing a single XML with multiple DOCTYPE declarations (versions 5.9.3–5.10.1), addInputEntities() repeatedly resets entity-expansion limits, allowing repeated resets within one parse. This can cause excessive CPU use, event-loop...
EUVD-2026-58184
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...
CLSA-2026-1786373314 TuxCare security update for fast-xml-parser (1 CVE)
TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.3-tuxcare.5...
@bpmiq/mcp (>=1.0.0, <=2.3.0), @bpmiq/validator (>=1.0.0, <=2.3.0) +93 more potentially affected by CVE-2026-73569 via fast-xml-parser (>=5.9.3, <=5.10.0)
fast-xml-parser NPM version =5.9.3, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =1.18.42-test.0, =1.6.6, =0.24.0, =5.1.22, =5.1.22, =0.0.1, =0.0.1, =49.13.0, =50.0.0, =50.0.7 and more Source cves: CVE-2026-73569 Source advisory: OSV:GHSA-8R6M-32JQ-JX6Q...
GHSA-8R6M-32JQ-JX6Q fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
Impact fast-xml-parser processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to @nodable/entities through addInputEntities. addInputEntities resets the entity expansion counters every time it is called. An attacker can therefore insert...
@bpmiq/mcp (>=1.0.0, <=2.3.0), @bpmiq/validator (>=1.0.0, <=2.3.0) +93 more potentially affected by unknown CVE via fast-xml-parser (>=5.9.3, <=5.10.0)
fast-xml-parser NPM version =5.9.3, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =1.18.42-test.0, =1.6.6, =0.24.0, =5.1.22, =5.1.22, =0.0.1, =0.0.1, =49.13.0, =50.0.0, =50.0.7 and more Source cves: unknown CVE Source advisory: SNYK:JS-FASTXMLPARSER-18170229...
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Overview org.webjars.npm:fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to Improper Restriction of Recursive Entity References in DTDs 'XML Entity Expansion' via the addInputEntities function. An attacker can...