Security vulnerabilities and automated fixes for fast xml parser issues
3 posts found
CVE-2026-25896 is a critical Cross-Site Scripting vulnerability in fast-xml-parser versions prior to 4.5.4 and 5.3.5, caused by improper handling of DOCTYPE entity declarations during XML parsing. The fix upgrades the dependency and applies a pnpm override to ensure no transitive dependency can pull in the vulnerable version. This vulnerability was detected by Trivy in the project's `pnpm-lock.yaml` and patched via an automated pull request.
CVE-2026-25896 is a critical Cross-Site Scripting vulnerability in the `fast-xml-parser` npm package caused by improper handling of DOCTYPE entity declarations. The flaw was discovered in the `mail-worker` service's dependency tree and patched by upgrading to version 5.3.5/4.5.4 and enforcing the fix via a pnpm override to `5.7.0`. Left unpatched, this vulnerability could allow attackers to inject malicious scripts through crafted XML payloads processed by the mail pipeline.
A critical denial of service vulnerability (CVE-2026-33036) was discovered in fast-xml-parser versions prior to 5.5.6 and 4.5.5, allowing attackers to bypass entity expansion limits and crash Node.js applications through malicious XML payloads. This fix upgrades the dependency in the scripts directory to patched versions, protecting build pipelines and any runtime XML processing from resource exhaustion attacks.