fast-xml-parser

fast-xml-parser has RangeError DoS Numeric Entities Bug

fast-xml-parser vulnerable to ReDOS at currency parsing

fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name

Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser

fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

fast-xml-parser vulnerable to Regex Injection via Doctype Entities

fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters