27 Releases 27 Tags

RSS Feed

• v1.1.9 88e520aa59

  Compare

  v1.1.9 Stable

  Keli Grubb released this 2026-08-13 17:14:52 +00:00 | 6 commits to main since this release

  Changelog

  Changed

  • update dependency fast-xml-parser to v5.10.1 [security] (#42)

  This PR contains the following updates:

  Package	Change	Age	Confidence
  fast-xml-parser	5.9.3 → 5.10.1

  ---

  fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

  GHSA-8r6m-32jq-jx6q

  More information

  Details

  Impact

  fast-xml-parser processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to @nodable/entities through addInputEntities().

  addInputEntities() resets the entity expansion counters every time it is called. An attacker can therefore insert additional DOCTYPE declarations to repeatedly reset maxTotalExpansions and maxExpandedLength during one parse operation.

  This allows a crafted XML document to exceed the configured entity-expansion limits and can cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination.

  Workarounds

  • Manually check if multiple DOCTYPEs are not present in input contents
  • Update to v5.10.1
  • Keep processEntity flag off

  Severity

  • CVSS Score: 8.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

  References

  • https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q
  • https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f
  • https://github.com/NaturalIntelligence/fast-xml-parser
  • https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1

  This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

  ---

  Release Notes

  NaturalIntelligence/fast-xml-parser (fast-xml-parser)

  v5.10.1

  Compare Source

  Full Changelog: https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.10.0...v5.10.1

  v5.10.0

  Compare Source

  What's Changed

  • Bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in #​849
  • Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @​dependabot[bot] in #​848

  Full Changelog: https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.9.3...v5.10.0

  ---

  • If you want to rebase/retry this PR, check this box

  Installation

  • Docker image
  • Helm chart

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)