# CVE-2024-34392: libxmljs type confusion in namespaces parsing

Source: https://junglewise.ai/threats/cve-2024-34392-libxmljs-type-confusion-in-namespaces-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-05-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-34392 · Severity: low · CVSS 3.1 · Published 2024-05-02

libxmljs is an XML parsing library widely used in Node.js applications. A type confusion vulnerability in its namespaces() function allows an attacker to craft malicious XML files that, when parsed by a vulnerable application, can crash the service or execute arbitrary code on the server running the application.

Technologies: [libxmljs (npm)](https://junglewise.ai/threats/technologies/libxmljs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-34392 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-34392 being exploited in the wild.

**How severe is CVE-2024-34392?** Low severity, with a CVSS score of 3.1, published 2 May 2024.

**Which products and versions are affected?** libxmljs (npm) SEMVER:introduced=0,last_affected=1.0.11.

**Is there a fix for CVE-2024-34392?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-34392 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-34392?** Check whether you run libxmljs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a type confusion (CWE-843) in the SWIG-generated wrapper function _wrap__xmlNode_nsDef_get() within libxmljs. When the namespaces() function is invoked on a grandchild node that refers to an XML entity in specially crafted XML, a pointer type mismatch occurs that allows the function to operate on an incorrect object type. The attack requires network access to send the malicious XML to an application using libxmljs, but does not require authentication or user interaction. An attacker can achieve denial of service through crashes or remote code execution by exploiting the confused pointer reference. Versions through 1.0.11 are affected; patch availability should be confirmed in the upstream repository.

## Affected products

- libxmljs libxmljs through 1.0.11

## Identifiers

- CVE-2024-34392
- GHSA-mg49-jqgw-gcj6

## Timeline

- 2024-05-02: disclosed: Published to GHSA and NVD
- 2023-11-27: other: Issue reported to GitHub

## References

- [https://github.com/libxmljs/libxmljs/issues/646](https://github.com/libxmljs/libxmljs/issues/646)

## Related threats

- [libxmljs segmentation fault in entity node parsing](https://junglewise.ai/threats/cve-2025-25341-libxmljs-segmentation-fault-in-entity-node-parsing)
- [libxmljs type confusion in attrs() on entity nodes](https://junglewise.ai/threats/cve-2024-34391-libxmljs-type-confusion-in-attrs-on-entity-nodes)
- [libxmljs denial of service in parseXml](https://junglewise.ai/threats/cve-2022-21144-libxmljs-denial-of-service-in-parsexml)