TI-2023-16950 Aliases CVE-2023-34104 GHSA-6w63-h3fj-q4vw

Regex Injection via Doctype Entities

LOW 35CWE-1333Published 2023-06-06 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denial of service (DoS) attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time. This problem has been resolved in v4.2.4. Users are advised to upgrade. Users unable to upgrade should avoid using DOCTYPE parsing by setting the `processEntities: false` option.

Why it matters now

EPSS 0.01126 66th percentileScored 2026-11-07

Fix Partial fast-xml-parser (NaturalIntelligence): 4.2.4fast-xml-parser (npm): 4.2.4Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NaturalIntelligence	fast-xml-parser	4.1.3 to before 4.2.4	4.2.4	Patch available	CNA
—	fast-xml-parser (npm)	4.1.3 to before 4.2.4	4.2.4	Patch available	GHSA-6w63-h3fj-q4vw

fast-xml-parser VendorNaturalIntelligence Affected 4.1.3 to before 4.2.4 Fixed in 4.2.4 Patch available CNA
fast-xml-parser (npm) Vendor— Affected 4.1.3 to before 4.2.4 Fixed in 4.2.4 Patch available GHSA-6w63-h3fj-q4vw

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:naturalintelligence:fast-xml-parser::::::::	before 4.2.4	Vulnerable	NaturalIntelligence

cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:* Versions before 4.2.4 Vulnerable ·NaturalIntelligence

Remediation

Fix · CNA fast-xml-parser (NaturalIntelligence) Fixed in 4.2.4
Fix · GHSA-6w63-h3fj-q4vw fast-xml-parser (npm) Fixed in 4.2.4 Advisory →

Red Hat 1 advisory

RHSA-2023:4627 Released 2023-08-14 · Red Hat rating Important
Migration Toolkit for Applications security and bug fix update
- MTA 6.2 for RHEL 8 mta/mta-hub-rhel9, mta/mta-operator-bundle, mta/mta-ui-rhel9 +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
OpenShift Serverless	Affected	No fix yet
Red Hat OpenShift Virtualization 4	Affected	No fix yet
MTA 6.2 for RHEL 8	Fixed	RHSA-2023:4627

Not affected: 1 product

MTA 6.2 for RHEL 8

Timeline

2026-10-02 Threatist record created from CVE-2023-34104
2026-10-03 Alias added: GHSA-6w63-h3fj-q4vw

References

Patch 1

https://github.com/NaturalIntelligence/fast-xml-parser/commit/39b0e050bb909e8499478657f84a3076e39ce76c

Advisory 2

Other 2

TI-2026-20935 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names CVSS 3.1CRITICAL 9.3
TI-2026-25482 fast-xml-parser affected by numeric entity expansion bypassing all entity expansion… CVSS 3.1HIGH 7.5
TI-2026-20291 fast-xml-parser has RangeError DoS Numeric Entities Bug CVSS 3.1HIGH 7.5
TI-2026-30169 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters CVSS 3.1MEDIUM 6.1
TI-2026-25755 fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation CVSS 3.1MEDIUM 5.9
TI-2026-21247 fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) CVSS 3.1HIGH 7.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences