Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
naturalintelligence/fast-xml-parser
master @ 93a09f1
21
Fixes
9
CVEs
CRITICAL
Peak severity
30.0%
Coverage
Highlights
Denial of Service: 12 prior fixes. Scrutinize any change in this area.
src/xmlparser/OrderedObjParser.js: most-fixed (10 issues). Treat as high-risk during review.
10 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Denial of Service: Billion Laughs entity expansion attacks and numeric entity parsing issues frequently crash the parser or exhaust memory. Key patches introduced dependency alignment with @nodable/entities and entity-expansion counting limits within loop structures.
Prototype Pollution: Parsing XML nodes into JavaScript object properties introduces high risk of prototype pollution via reserved property names like __proto__ or constructor. Mitigations include strict validation of reserved names and structural isolation during parsing.
Denial of Service: The DOCTYPE parser is highly sensitive to entity-based exhaustion. Attackers can bypass expansion checks via malformed entity declarations or negative values for maximum limits if they are not explicitly restricted and normalized to positive minimum bounds.