Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
Aug 13, 2026fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks.CVE-2026-73569 · Other software · NaturalIntelligence · reported by GitHubHigh 8.7
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.
- Product
- fast-xml-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks.CVE-2026-41650 · Other software · NaturalIntelligence · reported by GitHubMedium 6.1
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.
- Product
- fast-xml-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks.CVE-2026-33349 · Other software · NaturalIntelligence · reported by GitHubMedium 5.9
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero bytes — the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, completely bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded entity expansion, leading to memory exhaustion and denial of service. This issue has been patched in version 5.5.7.
- Product
- fast-xml-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks.CVE-2026-33036 · Other software · NaturalIntelligence · reported by GitHubHigh 7.5
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, &#xHH;) and standard XML entities completely evade the entity expansion limits (e.g., maxTotalExpansions, maxExpandedLength) added to fix CVE-2026-26278, enabling XML entity expansion Denial of Service. The root cause is that replaceEntitiesValue() in OrderedObjParser.js only enforces expansion counting on DOCTYPE-defined entities while the lastEntities loop handling numeric/standard entities performs no counting at all. An attacker supplying 1M numeric entity references like A can force ~147MB of memory allocation and heavy CPU usage, potentially crashing the process—even when developers have configured strict limits. This issue has been fixed in version 5.5.6.
- Product
- fast-xml-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback.CVE-2026-27942 · Other software · NaturalIntelligence · reported by GitHubLow 2.7
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder.
- Product
- fast-xml-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback.CVE-2026-25896 · Other software · NaturalIntelligence · reported by GitHubCritical 9.3
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.
- Product
- fast-xml-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback.CVE-2026-26278 · Other software · NaturalIntelligence · reported by GitHubHigh 7.5
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.
- Product
- fast-xml-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2026fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback.CVE-2026-25128 · Other software · NaturalIntelligence · reported by GitHubHigh 7.5
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `�` or `�`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue.
- Product
- fast-xml-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2024fast-xml-parser is an open source, pure javascript xml parser.CVE-2024-41818 · Other software · NaturalIntelligence · reported by GitHubHigh 7.5
fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerability is fixed in 4.4.1.
- Product
- fast-xml-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.CVE-2023-26920 · Other software · Naturalintelligence · reported by MITREMedium 6.5
fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.
- Product
- Fast XML Parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jun 6, 2023fast-xml-parser is an open source, pure javascript xml parser.CVE-2023-34104 · Other software · NaturalIntelligence · reported by GitHubHigh 7.5
fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denial of service (DoS) attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time. This problem has been resolved in v4.2.4. Users are advised to upgrade. Users unable to upgrade should avoid using DOCTYPE parsing by setting the `processEntities: false` option.
- Product
- fast-xml-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.