chore(deps): update dependency fast-xml-parser to v5.10.1 [security] #42

Merged

Keli Grubb merged 1 commits from renovate/npm-fast-xml-parser-vulnerability into main 2026-08-13 17:14:36 +00:00

Conversation 0 Commits 1 Files Changed 1

+33 -18

Renovate Bot commented 2026-08-13 15:01:23 +00:00

Collaborator

Copy Link

Copy Source

This PR contains the following updates:

Package	Change	Age	Confidence
fast-xml-parser	5.9.3 → 5.10.1

---

fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

GHSA-8r6m-32jq-jx6q

More information

Details

Impact

fast-xml-parser processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to @nodable/entities through addInputEntities().

addInputEntities() resets the entity expansion counters every time it is called. An attacker can therefore insert additional DOCTYPE declarations to repeatedly reset maxTotalExpansions and maxExpandedLength during one parse operation.

This allows a crafted XML document to exceed the configured entity-expansion limits and can cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination.

Workarounds

• Manually check if multiple DOCTYPEs are not present in input contents
• Update to v5.10.1
• Keep processEntity flag off

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q
• https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f
• https://github.com/NaturalIntelligence/fast-xml-parser
• https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

NaturalIntelligence/fast-xml-parser (fast-xml-parser)

v5.10.1

Compare Source

Full Changelog: https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.10.0...v5.10.1

v5.10.0

Compare Source

What's Changed

• Bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in #​849
• Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @​dependabot[bot] in #​848

Full Changelog: https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.9.3...v5.10.0

---

• If you want to rebase/retry this PR, check this box

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | [`5.9.3` → `5.10.1`](https://renovatebot.com/diffs/npm/fast-xml-parser/5.9.3/5.10.1) |  |  | --- ### fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits [GHSA-8r6m-32jq-jx6q](https://github.com/advisories/GHSA-8r6m-32jq-jx6q) <details> <summary>More information</summary> #### Details ##### Impact `fast-xml-parser` processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to `@nodable/entities` through `addInputEntities()`. `addInputEntities()` resets the entity expansion counters every time it is called. An attacker can therefore insert additional DOCTYPE declarations to repeatedly reset maxTotalExpansions and maxExpandedLength during one parse operation. This allows a crafted XML document to exceed the configured entity-expansion limits and can cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. ##### Workarounds - Manually check if multiple DOCTYPEs are not present in input contents - Update to v5.10.1 - Keep `processEntity` flag off #### Severity - CVSS Score: 8.7 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q](https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q) - [https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f](https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f) - [https://github.com/NaturalIntelligence/fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) - [https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-8r6m-32jq-jx6q) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>NaturalIntelligence/fast-xml-parser (fast-xml-parser)</summary> ### [`v5.10.1`](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1) [Compare Source](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.10.0...v5.10.1) **Full Changelog**: <https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.10.0...v5.10.1> ### [`v5.10.0`](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.0) [Compare Source](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.9.3...v5.10.0) #### What's Changed - Bump actions/checkout from 6.0.3 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;849](https://github.com/NaturalIntelligence/fast-xml-parser/pull/849) - Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;848](https://github.com/NaturalIntelligence/fast-xml-parser/pull/848) **Full Changelog**: <https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.9.3...v5.10.0> </details> --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yOC4wIiwidXBkYXRlZEluVmVyIjoiNDQuMjguMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwic2VjdXJpdHkiXX0=-->

Renovate Bot added the dependenciessecurity labels 2026-08-13 15:01:23 +00:00

Renovate Bot added 1 commit 2026-08-13 15:01:23 +00:00

chore(deps): update dependency fast-xml-parser to v5.10.1 [security] 2bfd013eff

Keli Grubb merged commit 5aa3bd8977 into main 2026-08-13 17:14:36 +00:00

Keli Grubb deleted branch renovate/npm-fast-xml-parser-vulnerability 2026-08-13 17:14:36 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

dependencies

Pull requests that update a dependency file

security

Vulnerability-driven dependency update

No labels dependencies security

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

jasper (Jasper) marshallgrubb (Marshall Grubb) renovate-bot (Renovate Bot) keligrubb (Keli Grubb)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: keligrubb/kestrelos#42