NaturalIntelligence vulnerabilities

Products

• fast-xml-parser 11
• fast xml parser 2
• fast-xml-builder 2

Latest NaturalIntelligence CVEs

Newest publication first

1. CVE-2026-126066 fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags

   Published 2026-11-10

   Low·CVSS 3.7 EPSS 0.46%

   fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData() in OrderedObjParser.js calls readTagExp() for each less-than character in an unterminated s...

2. CVE-2026-73569 fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

   Published 2026-08-13

   High·CVSS 8.7 EPSS 0.51%

   fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through ad...

3. CVE-2026-44664 fast-xml-builder: Comment Value bypass regex

   Published 2026-05-13

   Medium·CVSS 6.1 EPSS 0.19%

   fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., --->...), allowing an attacker to break out o...

4. CVE-2026-44665 fast-xml-builder: Attribute values with unwanted quotes can bypass malicious or unwanted attributes

   Published 2026-05-13

   Medium·CVSS 6.1 EPSS 0.24%

   fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML....

5. CVE-2026-41650 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

   Published 2026-05-07

   Medium·CVSS 6.1 EPSS 0.24%

   fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This...

6. CVE-2026-33349 fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation

   Published 2026-03-24

   Medium·CVSS 5.9 EPSS 0.48%

   fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration...

7. CVE-2026-33036 fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

   Published 2026-03-20

   High·CVSS 7.5 EPSS 0.61%

   fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, &#xHH;) and standard XML entities completely evade the entity expa...

8. CVE-2026-27942 fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

   Published 2026-02-26

   Low·CVSS 2.7 EPSS 0.54%

   fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with preserveOrder:true. Version 5.3.8 fi...

9. CVE-2026-25896 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

   Published 2026-02-20

   Critical·CVSS 9.3 EPSS 0.53%

   fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an att...

10. CVE-2026-26278 fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

    Published 2026-02-19

    High·CVSS 7.5 EPSS 0.94%

    fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML inpu...

11. CVE-2026-25128 fast-xml-parser has RangeError DoS Numeric Entities Bug

    Published 2026-01-30

    High·CVSS 7.5 EPSS 0.61%

    fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML...

12. CVE-2024-41818 ReDOS at currency parsing fast-xml-parser

    Published 2024-07-29

    High·CVSS 7.5 EPSS 0.83%

    fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerability is fixed in 4.4.1.

13. CVE-2023-26920 fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name

    Published 2023-12-12

    Medium·CVSS 6.5 EPSS 1.2%

    fast-xml-parser before 4.1.2 allows proto for Prototype Pollution.

14. CVE-2023-34104 Regex Injection via Doctype Entities

    Published 2023-06-06

    High·CVSS 7.5 EPSS 1.1%

    fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.