CVE-2023-34104 — Uncontrolled Resource Consumption

Vendor	Product	Version range	Fixed in
debian	node-webfont	—	—
naturalintelligence	fast-xml-parser	< 4.2.4	4.2.4
naturalintelligence	fast-xml-parser	—	—
naturalintelligence	fast-xml-parser	>= 0 < 5.7.0	5.7.0
naturalintelligence	fast-xml-parser	>= 4.1.3 < 4.5.4	4.5.4
naturalintelligence	fast-xml-parser	>= 4.1.3 < 4.2.4	4.2.4
naturalintelligence	fast-xml-parser	>= 5.0.0 < 5.3.5	5.3.5

GHSA

fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

ghsa·2026-04-22·CVSS 6.5

CVE-2026-41650 [MEDIUM] CWE-91 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters # fast-xml-parser XMLBuilder: Comment and CDATA Injection via Unescaped Delimiters ## Summary fast-xml-parser XMLBuilder does not escape the `-->` sequence in comment content or the `]]>` sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. Existing CVEs for fast-xml-parser cover different issues: - CVE-2023-26920: Prototype pollution (parser) - CVE-2023-34104: ReDoS (parser) - CVE-2026-27942: Stack overflow in XMLBuilder with preserveOrder - CVE-2026-25896: Entity encoding bypass via regex in DOCTYPE entities This finding covers **unescaped

GHSA

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

ghsa·2026-02-20·CVSS 7.5

CVE-2026-25896 [HIGH] CWE-185 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names # Entity encoding bypass via regex injection in DOCTYPE entity names ## Summary A dot (`.`) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (` `, `&`, `"`, `'`) with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. ## Details The fix for CVE-2023-34104 addressed some regex metacharacters in entity names but missed `.` (period), which is valid in XML names per the W3C spec. In `DocTypeReader.js`, entity names are passed directly to `RegExp()`: ```js entities[entityName] = { regx: RegExp(`&${entityName};`, "g"), val: val }; ``` An entity named `l.` produces the

OSV

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

osv·2026-02-20·CVSS 7.5

CVE-2026-25896 [HIGH] fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names # Entity encoding bypass via regex injection in DOCTYPE entity names ## Summary A dot (`.`) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (` `, `&`, `"`, `'`) with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. ## Details The fix for CVE-2023-34104 addressed some regex metacharacters in entity names but missed `.` (period), which is valid in XML names per the W3C spec. In `DocTypeReader.js`, entity names are passed directly to `RegExp()`: ```js entities[entityName] = { regx: RegExp(`&${entityName};`, "g"), val: val }; ``` An entity named `l.` produces the

OSV

fast-xml-parser vulnerable to Regex Injection via Doctype Entities

osv·2023-06-06

CVE-2023-34104 [HIGH] fast-xml-parser vulnerable to Regex Injection via Doctype Entities fast-xml-parser vulnerable to Regex Injection via Doctype Entities ### Impact "fast-xml-parser" allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for DoS attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time. ### Patches The problem has been resolved in v4.2.4 ### Workarounds Avoid using DOCTYPE parsing by `processEntities: false` option.

GHSA

fast-xml-parser vulnerable to Regex Injection via Doctype Entities

ghsa·2023-06-06

CVE-2023-34104 [HIGH] CWE-1333 fast-xml-parser vulnerable to Regex Injection via Doctype Entities fast-xml-parser vulnerable to Regex Injection via Doctype Entities ### Impact "fast-xml-parser" allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for DoS attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time. ### Patches The problem has been resolved in v4.2.4 ### Workarounds Avoid using DOCTYPE parsing by `processEntities: false` option.

Red Hat

fast-xml-parser: Regex Injection via Doctype Entities

vendor_redhat·2023-06-06·CVSS 7.5

CVE-2023-34104 [HIGH] CWE-917 fast-xml-parser: Regex Injection via Doctype Entities fast-xml-parser: Regex Injection via Doctype Entities fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denial of service (DoS) attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time. This problem has been resolved in v4.2.4. Users are advised to upgrade. Users unable to upgrade should avoid using DOCTYPE parsing by setting the `processEntities: false` option. A flaw was found in the fas

Debian

CVE-2023-34104: node-webfont - fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser a...

vendor_debian·2023·CVSS 7.5

CVE-2023-34104 [HIGH] CVE-2023-34104: node-webfont - fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser a... fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denial of service (DoS) attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time. This problem has been resolved in v4.2.4. Users are advised to upgrade. Users unable to upgrade should avoid using DOCTYPE parsing by setting the `processEntities: false` option. Scope: local bookworm: resolved forky: resolved sid: resolved trixie: resolved

CVE-2023-34104: fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized…

Affected

CVSS provenance