npm package report

Is fast-xml-parser safe?

12 known vulnerabilities, worst severity CRITICAL.

cvss

7.1

how bad it is if exploited, out of 10

epss

0.50%

chance of exploitation in the next 30 days

xyz score

5.3

CyberXYZ composite, out of 10

fig. 01 — GHSA-m7jm-9gc2-mpf2, the advisory selected below

// advisories

GHSA-m7jm-9gc2-mpf2

CRITICALCVE-2026-25896

A dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered.

Affected: >= 5.0.0, < 5.3.5
Fixed in: 5.3.5
Weakness: CWE-185
Published: 2026-02-20
Source: github

GHSA NVD MITRE reference reference reference reference

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-09-22 at 01:41 UTC. The most recent advisory here was published 2026-07-21. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is fast-xml-parser safe? npm package security report | CyberXYZ