An open index of dependabot pull requests across open source projects.

fast-xml-parser

Ecosystem:
npm
Package URL:
pkg:npm/fast-xml-parser
Total PRs:
6,662 Dependabot PRs
Latest PR:
3 days ago
Unique Repositories:
3,746 repositories
Unique Repos (30 days):
214 repositories
Security Advisories
Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser
GHSA-jp2q-39xq-3w4g CVE-2026-33349 MODERATE published 3 months ago • updated 3 days ago
## Summary The `DocTypeReader` in fast-xml-parser uses JavaScript truthy checks to evaluate `maxEntityCount` and `maxEntitySize` configuration lim...
fast-xml-parser has RangeError DoS Numeric Entities Bug
GHSA-37qj-frw5-hhjh CVE-2026-25128 HIGH published 4 months ago • updated 1 day ago
### Summary A RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code po...
fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name
GHSA-x3cc-x39p-42qx CVE-2023-26920 MODERATE published almost 3 years ago • updated 3 days ago
### Impact As a part of this vulnerability, user was able to se code using `__proto__` as a tag or attribute name. ```js const { XMLParser, XMLBui...
fast-xml-parser vulnerable to Regex Injection via Doctype Entities
GHSA-6w63-h3fj-q4vw CVE-2023-34104 HIGH published almost 3 years ago • updated 3 days ago
### Impact "fast-xml-parser" allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creat...
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
GHSA-m7jm-9gc2-mpf2 CVE-2026-25896 CRITICAL published 3 months ago • updated 27 days ago
# Entity encoding bypass via regex injection in DOCTYPE entity names ## Summary A dot (`.`) in a DOCTYPE entity name is treated as a regex wildca...
Recent PRs (filtered by: Open , Patch PRs )
Bump fast-xml-parser from 5.7.2 to 5.7.3

mitre/heimdall2 #8064

5.7.2 → 5.7.3 Patch PR
Open about 1 month ago 2 comments
mitre
Package Details
Name: fast-xml-parser
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/fast-xml-parser
JSON API: View JSON
Security Advisories

11

Active advisories
CRITICAL 1
HIGH 5
MODERATE 3
LOW 2
View All npm Advisories
Package Information
Description:

Validate XML, Parse XML, Build XML without C/C++ based libraries

Repository: https://github.com/NaturalIntelligence/fast-xml-parser
Homepage: https://github.com/NaturalIntelligence/fast-xml-parser#readme
Latest Release: 5.2.3
about 1 year ago
Dependent Repos: 157,710
Dependent Packages: 1,935
Downloads: 136,945,118
Ranking: Top 0.0824% by dependent repos Top 0.0233% by downloads Top 0.0402% by dependent pkgs
PR Status
Open 2,488 (37.3%)
Merged 187 (2.8%)
Closed 3,770 (56.6%)
PR Types
Major 1,449 (21.8%)
Minor 3,002 (45.1%)
Patch 1,961 (29.4%)
Removal 19 (0.3%)