ReDOS at currency parsing fast-xml-parser
Priority MEDIUM 40CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 6 fixed, 3 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerability is fixed in 4.4.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00828 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial fast-xml-parser (NaturalIntelligence): 4.4.1fast-xml-parser (npm): 4.4.1Red Hat: 4 advisoriesRed Hat: 6 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NaturalIntelligence | fast-xml-parser | 4.3.5 to before 4.4.1 | 4.4.1 | Patch available | CNA |
| — | fast-xml-parser (npm) | 4.3.5 to before 4.4.1 | 4.4.1 | Patch available | GHSA-mpg4-rc92-vx8v |
- fast-xml-parser VendorNaturalIntelligence Affected 4.3.5 to before 4.4.1 Fixed in 4.4.1 Patch available CNA
- fast-xml-parser (npm) Vendor— Affected 4.3.5 to before 4.4.1 Fixed in 4.4.1 Patch available GHSA-mpg4-rc92-vx8v
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:naturalintelligence:fast-xml-parser:4.2.4:*:*:*:*:*:*:* | 4.2.4 | Vulnerable | NaturalIntelligence |
- cpe:2.3:a:naturalintelligence:fast-xml-parser:4.2.4:*:*:*:*:*:*:* Versions 4.2.4 Vulnerable ·NaturalIntelligence
Remediation
- Fix · CNA fast-xml-parser (NaturalIntelligence) Fixed in 4.4.1
- Fix · GHSA-mpg4-rc92-vx8v fast-xml-parser (npm) Fixed in 4.4.1 Advisory →
Red Hat 4 advisories
- RHSA-2024:8676 Released 2024-10-30 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.17.0 Security, Enhancement, & Bug Fix Update
- RHODF 4.17 for RHEL 9 odf4/mcg-core-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +3
- RHSA-2024:7624 Released 2024-10-03 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.14.11 security and bug fix update
- RHODF 4.14 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9
- RHSA-2024:6755 Released 2024-09-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16.2 security and bug fix update
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/ocs-client-console-rhel9 +7
Show 1 more Red Hat advisories
- RHSA-2024:5054 Released 2024-08-06 · Red Hat rating ImportantOpenShift Virtualization 4.16.1 Images security update
- CNV 4.16 for RHEL 9 container-native-virtualization/hostpath-csi-driver-rhel9, container-native-virtualization/kubevirt-console-plugin-rhel9, container-native-virtualization/virt-cdi-cloner-rhel9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Applications 6 | Affected | No fix planned: Will not fix |
| OpenShift Serverless | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| CNV 4.16 for RHEL 9 | Fixed | RHSA-2024:5054 |
| RHOAI-2.13-RHEL-8 | Fixed | — |
| RHODF 4.14 for RHEL 9 | Fixed | RHSA-2024:7624 |
| RHODF 4.16 for RHEL 9 | Fixed | RHSA-2024:6755 |
| RHODF 4.17 for RHEL 9 | Fixed | RHSA-2024:8676 |
| Red Hat Developer Hub 1.2 for RHEL 9 | Fixed | — |
Not affected: 7 products
- CNV 4.16 for RHEL 9
- Migration Toolkit for Applications 7
- RHODF 4.14 for RHEL 9
- RHODF 4.16 for RHEL 9
- RHODF 4.17 for RHEL 9
- Red Hat Developer Hub 1
- Red Hat Developer Hub 1.2 for RHEL 9
Timeline
- 2026-10-02 Threatist record created from CVE-2024-41818
- 2026-10-03 Alias added: GHSA-mpg4-rc92-vx8v
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-30 Fix available: RHOAI-2.13-RHEL-8 · Red Hat
References
Exploit 1
More NaturalIntelligence Fast-xml-parser vulnerabilities
- TI-2026-20935 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names CVSS 3.1CRITICAL 9.3
- TI-2026-25482 fast-xml-parser affected by numeric entity expansion bypassing all entity expansion… CVSS 3.1HIGH 7.5
- TI-2026-20291 fast-xml-parser has RangeError DoS Numeric Entities Bug CVSS 3.1HIGH 7.5
- TI-2026-30169 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters CVSS 3.1MEDIUM 6.1
- TI-2026-25755 fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation CVSS 3.1MEDIUM 5.9
- TI-2026-21247 fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) CVSS 3.1HIGH 7.5
Sources
- CVE-2024-41818 · CVE Program
- CVE-2024-41818 · NVD
- FIRST EPSS
- GHSA-mpg4-rc92-vx8v · GitHub Advisory Database · CC BY 4.0
- CVE-2024-41818 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences