# CVE-2023-34104: fast-xml-parser regex injection via DOCTYPE entities

Source: https://junglewise.ai/threats/cve-2023-34104-fast-xml-parser-regex-injection-via-doctype-entities  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-06-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-34104 · Severity: low · CVSS 3.1 · Published 2023-06-06

fast-xml-parser is a JavaScript library used to parse and process XML documents in web applications. An attacker can craft a malicious XML document with specially crafted entity names that cause the parser's regex engine to enter an infinite or extremely slow loop, leading to a denial of service that freezes or crashes the application.

Technologies: [fast-xml-parser (npm)](https://junglewise.ai/threats/technologies/fast-xml-parser). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-34104 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-34104 being exploited in the wild.

**How severe is CVE-2023-34104?** Low severity, with a CVSS score of 3.1, published 6 June 2023.

**Which products and versions are affected?** fast-xml-parser (npm) SEMVER:introduced=4.1.3,fixed=4.2.4.

**Is there a fix for CVE-2023-34104?** Yes. fast-xml-parser (npm): upgrade to 4.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-34104 attacked?** It is attacked over the network.

**Am I affected by CVE-2023-34104?** Check whether you run fast-xml-parser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fast-xml-parser (npm): upgrade to 4.2.4 or later

  ```sh
  npm install fast-xml-parser@4.2.4
  ```


## Technical details

This vulnerability is a ReDoS (Regular Expression Denial of Service) attack via unescaped entity names in DOCTYPE declarations. The library unsanitized entity names to construct a regex pattern used for entity replacement in the XML body, allowing attackers to inject special regex metacharacters. By creating an entity with a name that produces a pathologically slow regex (e.g., catastrophic backtracking), an attacker can cause the parser to hang indefinitely during the entity replacement phase. This occurs when DOCTYPE entity processing is enabled (default behavior). The vulnerability affects versions 4.1.3 through 4.2.3 and is fixed in v4.2.4; users can mitigate by disabling entity processing with the processEntities: false option.

## Affected products

- NaturalIntelligence fast-xml-parser 4.1.3 to 4.2.3

## Identifiers

- CVE-2023-34104
- GHSA-6w63-h3fj-q4vw

## Timeline

- 2023-06-06: disclosed
- 2023-06-06: patched: version 4.2.4

## References

- [https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-6w63-h3fj-q4vw](https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-6w63-h3fj-q4vw)

## Related threats

- [fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags](https://junglewise.ai/threats/cve-2026-126066-fast-xml-parser-allows-users-to-process-xml-from-js-object)
- [fast-xml-parser DOCTYPE reset entity expansion limits bypass](https://junglewise.ai/threats/cve-2026-73569-fast-xml-parser-doctype-reset-entity-expansion-limits-bypass)
- [NaturalIntelligence fast-xml-parser XML injection in XMLBuilder](https://junglewise.ai/threats/cve-2026-41650-naturalintelligence-fast-xml-parser-xml-injection-in-xmlbuilder)
- [fast-xml-parser entity expansion bypass via falsy zero check](https://junglewise.ai/threats/cve-2026-33349-fast-xml-parser-entity-expansion-bypass-via-falsy-zero-check)
- [fast-xml-parser numeric entity expansion bypass](https://junglewise.ai/threats/cve-2026-33036-fast-xml-parser-numeric-entity-expansion-bypass)