Executive brief
fast-xml-parser is a widely-used JavaScript library for parsing XML documents. The library fails to validate numeric character entity values before processing them, allowing an attacker to send malformed XML that crashes the entire Node.js application. Any service that accepts XML input from users (APIs, file processors, feed parsers) can be disrupted with a single malicious request, requiring manual restart to restore service.
Technical details
The vulnerability is a missing input validation and exception handling issue (CWE-20, CWE-248) in the entity replacement logic. The regex patterns in OrderedObjParser.js lines 44–45 match numeric entities with values up to 9,999,999 (decimal) or 0xFFFFFF (hex), but the valid Unicode range is only 0–0x10FFFF (1,114,111). When String.fromCodePoint() is called with an out-of-range value, it throws a RangeError. The entity replacement function replaceEntitiesValue() at line 452 lacks a try-catch block, allowing the exception to propagate uncaught. The attack requires network reachability and no authentication; a single POST request with malicious XML triggers the crash. The vulnerability affects versions 5.0.9 through 5.3.3 and is fixed in version 5.3.4.
Affected products
- NaturalIntelligence fast-xml-parser 5.0.9 through 5.3.3
Timeline
- 2026-01-30: disclosed: Advisory GHSA-37qj-frw5-hhjh published
- 2026-01-30: patched: Fix released in version 5.3.4
References
- https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-37qj-frw5-hhjh
- https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e387f61c4a5cef792f6a2f42467013290bf95dc
- https://github.com/NaturalIntelligence/fast-xml-parser
- https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.4