Repository navigation
fix(deps): update dependency fast-xml-parser to v5.12.0 [security] - #5419
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
5.8.0→5.12.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags
CVE-2026-126066 / GHSA-474x-hrwr-fgx4
More information
Details
Summary
With the non-default stopNodes option, a stop node's body with many "<a " fragments and no closing ">" anywhere after makes readStopNodeData() rescan the entire remaining input from every "<". The failed lookahead is neither cached nor bounded, so n fragments cost O(n²) before the parser throws. Availability-only (CPU exhaustion), needs the non-default stopNodes option — not benchmarked yet, see Proof of Concept.
Details
CWE-407 — Inefficient Algorithmic Complexity
Code
OrderedObjParser.js:520—parseXml()callsreadStopNodeData()after a matching stop node opensOrderedObjParser.js:810— callsreadTagExp()for every non-special<OrderedObjParser.js:688-722—tagExpWithClosingIndex()scans to end-of-input and returnsundefinedwhen no>existsOrderedObjParser.js:812-818— on failure,iisn't advanced, so the next<repeats the same full scanOrderedObjParser.js:423— the main parse loop throws immediately on the same failure; only the stop-node path retriesRoot cause: a failed closing-
>lookahead is neither cached nor bounded —ncopies of<awith no later>meansnscans over the remaining input, O(n²) work, before it finally throws.Fix
readStopNodeData()whenreadTagExp()returnsundefined>once and reuse/bound that resultProof of concept
Not benchmarked — static-analysis finding, confidence 0.5.
To confirm: configure
stopNodesmatching a root element. Build input as'<stop>' + '<a '.repeat(n). Timeparse()until it throwsUnexpected end of <tag>. Start around n=10,000 and double it — quadratic should show ~4x time per doubling, linear ~2x. Control: same input with a>present, orstopNodesunset.Impact
CPU-exhaustion DoS in Node.js services parsing untrusted XML with
stopNodesenabled. A ~100KB payload is estimated at ~10⁹ character operations (roughly a second or more of blocked event loop) — analytical estimate, not a benchmark. No confidentiality/integrity impact. CVSS 3.1:AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L(3.7, Low).Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
NaturalIntelligence/fast-xml-parser (fast-xml-parser)
v5.12.0Compare Source
What's Changed
New Contributors
Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.2...v5.12.0
v5.11.2Compare Source
What's Changed
New Contributors
Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.1...v5.11.2
v5.11.1Compare Source
What's Changed
New Contributors
Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.0...v5.11.1
v5.11.0Compare Source
What's Changed
New Contributors
Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.1...v5.11.0
v5.10.1Compare Source
Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.0...v5.10.1
v5.10.0Compare Source
What's Changed
Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.3...v5.10.0
v5.9.3Compare Source
What's Changed
New Contributors
Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.2...v5.9.3
v5.9.2Compare Source
Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.1...v5.9.2
v5.9.1Compare Source
Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.0...v5.9.1
v5.9.0: update strnum, use is-unsafeCompare Source
Configuration
📅 Schedule: (in timezone Europe/Zurich)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.