This repository was archived by the owner on Mar 3, 2026. It is now read-only.
Repository navigation
This repository was archived by the owner on Mar 3, 2026. It is now read-only.
Security vulnerability with fast-xml-parser dependency #2709
Description
Searched for a similar issue but only found #2504 which was more than a year ago. It seems like there is another vulnerability affecting fast-xml-parser (GHSA-37qj-frw5-hhjh) versions 4.3.6 to 5.3.4, and @google-cloud/storage appears to depend on fast-xml-parser@4.5.3
Reacted by Co-7, Will Morgan, Simone Scanu, Derek Cicerone, yosefrev, Yangliu, Yuta Nakagawa, AmnezziaCS, Cristi Moldovan, Ivan Brezhniev and 59 more
Activity
deps: update fast-xml-parser to 5.3.4 due to security vulnerability
lalawow commentedon Feb 5, 2026
#2713
lalawow commentedon Feb 5, 2026
Let's hope this #2694 can be released soon.
vterzic-yokoy commentedon Feb 23, 2026
hi @ddelgrosso1 , it looks there is another security issue with
fast-xml-parserGHSA-m7jm-9gc2-mpf2I think we need another update 🙏
ddelgrosso1 commentedon Feb 25, 2026
cc: @Pulkit0110
iurisilvio commentedon Feb 26, 2026
No need for another update,
"fast-xml-parser": "^5.3.4"can be updated to a safe version (5.3.5+) without changes here.