GHSA-jmr7-xgp7-cmfj
High · 7.5CVSS
7.5
EPSS
—
Published
Feb 17, 2026
CISA due date
—
The record
fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | fast-xml-parser | 4.1.3 | 4.5.4 |
| npm | fast-xml-parser | 5.0.0 | 5.3.6 |
| Chainguard | dbgate | 0 | 7.0.6-r1 |
| Chainguard | dbgate-fips | 0 | 7.1.0-r0 |
| Chainguard | jitsucom-jitsu-console | 0 | 2.11.0-r15 |
| Chainguard | kibana-8.17 | 0 | 8.17.10-r10 |
| Chainguard | kibana-8.17-iamguarded | 0 | 8.17.10-r10 |
| Chainguard | kibana-8.19 | 0 | 8.19.11-r1 |
| Chainguard | kibana-8.19-bitnami | 0 | 8.19.11-r1 |
| Chainguard | kibana-8.19-iamguarded | 0 | 8.19.11-r1 |
| Chainguard | kibana-9.0 | 0 | 9.0.8-r10 |
| Chainguard | kibana-9.0-bitnami | 0 | 9.0.8-r10 |
| Chainguard | kibana-9.0-iamguarded | 0 | 9.0.8-r10 |
| Chainguard | kibana-9.1 | 0 | 9.1.10-r5 |
| Chainguard | kibana-9.1-iamguarded | 0 | 9.1.10-r5 |
| Chainguard | kibana-9.2 | 0 | 9.2.5-r3 |
| Chainguard | kibana-9.2-iamguarded | 0 | 9.2.5-r3 |
| Chainguard | kibana-9.3 | 0 | 9.3.0-r1 |
| Chainguard | kibana-9.3-iamguarded | 0 | 9.3.0-r1 |
| Chainguard | kubeflow-pipelines-frontend | 0 | 2.15.0-r12 |
| Chainguard | langfuse-2-worker | 0 | 2.95.12-r11 |
| Chainguard | langfuse-fips-2-worker | 0 | 2.95.12-r13 |
| Chainguard | librechat | 0 | 0.8.2-r3 |
| Chainguard | prism | 0 | 5.14.3-r7 |
| Chainguard | renovate | 0 | 43.48.3-r0 |
| Chainguard | tileserver-gl | 0 | 5.5.0-r5 |
| Chainguard | tileserver-gl-fips | 0 | 5.5.0-r6 |
| Wolfi | jitsucom-jitsu-console | 0 | 2.11.0-r15 |
| Wolfi | kubeflow-pipelines-frontend | 0 | 2.15.0-r12 |
| Wolfi | prism | 0 | 5.14.3-r7 |
| Wolfi | renovate | 0 | 43.48.3-r0 |
| Wolfi | tileserver-gl | 0 | 5.5.0-r5 |
Related vulnerabilities
- CVE-2026-26278 fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from… Same vulnerability
- CVE-2026-41650 fast-xml-parser allows users to process XML from JS object without C/C++ based libraries… Also affects fast-xml-parser
- GHSA-gh4j-gqv2-49f6 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters Also affects fast-xml-parser
- CVE-2026-33349 fast-xml-parser allows users to process XML from JS object without C/C++ based libraries… Also affects fast-xml-parser
- CVE-2026-33036 fast-xml-parser allows users to process XML from JS object without C/C++ based libraries… Also affects fast-xml-parser
- GHSA-jp2q-39xq-3w4g Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in… Also affects fast-xml-parser
- GHSA-8gc5-j5rx-235r fast-xml-parser affected by numeric entity expansion bypassing all entity expansion… Also affects fast-xml-parser
- GHSA-fj3w-jwp8-x2g3 fast-xml-parser has stack overflow in XMLBuilder with preserveOrder Also affects fast-xml-parser