NaturalIntelligence fast-xml-parser
10 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-73569 | >= 5.9.3, < 5.10.1 | fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits | HIGH 8.7 | 0.5 % | ||
| CVE-2026-41650 | < 5.7.0 | fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-33349 | >= 4.0.0-beta.3, < 5.5.7 | fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation | MEDIUM 5.9 | 0.5 % | ||
| CVE-2026-33036 | >= 4.0.0-beta.3, < 5.5.6 | fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) | HIGH 7.5 | 0.6 % | ||
| CVE-2026-27942 | < 5.3.8 | fast-xml-parser has stack overflow in XMLBuilder with preserveOrder | LOW 2.7 | 0.5 % | ||
| CVE-2026-25896 | >= 5.0.0, < 5.3.5 ; >= 4.1.3, < 4.5.4 | fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-26278 | >= 5.0.0, < 5.3.6 ; >= 4.1.3, < 4.5.4 | fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) | HIGH 7.5 | 0.9 % | ||
| CVE-2026-25128 | >= 5.0.9, <= 5.3.3 | fast-xml-parser has RangeError DoS Numeric Entities Bug | HIGH 7.5 | 0.6 % | ||
| CVE-2024-41818 | >= 4.3.5, < 4.4.1 | ReDOS at currency parsing fast-xml-parser | HIGH 7.5 | 0.8 % | ||
| CVE-2023-34104 | >= 4.1.3, < 4.2.4 | Regex Injection via Doctype Entities | HIGH 7.5 | 1.1 % |