[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
fast-xml-parser	5.10.1 → 5.12.0

---

fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags

CVE-2026-126066 / GHSA-474x-hrwr-fgx4

More information

Details

Summary

With the non-default stopNodes option, a stop node's body with many "<a " fragments and no closing ">" anywhere after makes readStopNodeData() rescan the entire remaining input from every "<". The failed lookahead is neither cached nor bounded, so n fragments cost O(n²) before the parser throws. Availability-only (CPU exhaustion), needs the non-default stopNodes option — not benchmarked yet, see Proof of Concept.

Details

CWE-407 — Inefficient Algorithmic Complexity

Code

• OrderedObjParser.js:520 — parseXml() calls readStopNodeData() after a matching stop node opens
• OrderedObjParser.js:810 — calls readTagExp() for every non-special <
• OrderedObjParser.js:688-722 — tagExpWithClosingIndex() scans to end-of-input and returns undefined when no > exists
• OrderedObjParser.js:812-818 — on failure, i isn't advanced, so the next < repeats the same full scan
• OrderedObjParser.js:423 — the main parse loop throws immediately on the same failure; only the stop-node path retries

Root cause: a failed closing-> lookahead is neither cached nor bounded — n copies of <a with no later > means n scans over the remaining input, O(n²) work, before it finally throws.

Fix

1. Throw immediately in readStopNodeData() when readTagExp() returns undefined
2. Or break the loop on the first failed scan
3. Or find the next > once and reuse/bound that result
4. Add a test asserting near-linear scaling when payload size doubles

Proof of concept

Not benchmarked — static-analysis finding, confidence 0.5.

To confirm: configure stopNodes matching a root element. Build input as '<stop>' + '<a '.repeat(n). Time parse() until it throws Unexpected end of <tag>. Start around n=10,000 and double it — quadratic should show ~4x time per doubling, linear ~2x. Control: same input with a > present, or stopNodes unset.

Impact

CPU-exhaustion DoS in Node.js services parsing untrusted XML with stopNodes enabled. A ~100KB payload is estimated at ~10⁹ character operations (roughly a second or more of blocked event loop) — analytical estimate, not a benchmark. No confidentiality/integrity impact. CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L (3.7, Low).

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-474x-hrwr-fgx4
• https://github.com/NaturalIntelligence/fast-xml-parser/commit/0c3659348364959da62954b73728fb3bd05ebcb4
• https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.12.0
• https://github.com/advisories/GHSA-474x-hrwr-fgx4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

NaturalIntelligence/fast-xml-parser (fast-xml-parser)

v5.12.0

Compare Source

What's Changed

• fix: add endIndex to the CommonJS XMLMetaData declaration by @​dualfroz in #​896
• Bump zizmorcore/zizmor-action from 0.6.1 to 0.8.0 by @​dependabot[bot] in #​906
• Bump actions/setup-node from 7.0.0 to 7.1.0 by @​dependabot[bot] in #​904
• fix: preserve original metadata offsets for CRLF input by @​Sskift in #​911
• docs: update NASA link in users list by @​CodeVertex55 in #​885
• README.md: fix documentation links by @​maxlath in #​872
• test: drop shadowed ignoreAttributes option by @​rajanpanth in #​863

New Contributors

• @​dualfroz made their first contribution in #​896
• @​Sskift made their first contribution in #​911
• @​CodeVertex55 made their first contribution in #​885
• @​maxlath made their first contribution in #​872

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.2...v5.12.0

v5.11.2

Compare Source

What's Changed

• fix: decode Uint8Array XML input as UTF-8 by @​emme1t in #​875
• fix: type EntityDecoderOptions.setXmlVersion's version as a number by @​YevheniiKotyrlo in #​880

New Contributors

• @​emme1t made their first contribution in #​875
• @​YevheniiKotyrlo made their first contribution in #​880

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.1...v5.11.2

v5.11.1

Compare Source

What's Changed

• Bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​858
• Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 by @​dependabot[bot] in #​856
• Bump actions/setup-node from 6.4.0 to 7.0.0 by @​dependabot[bot] in #​854
• docs: fix two 404 documentation links by @​rajanpanth in #​862

New Contributors

• @​rajanpanth made their first contribution in #​862

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.0...v5.11.1

v5.11.0

Compare Source

What's Changed

• add support for endIndex in node metadata (5.x edition) by @​Wain-PC in #​850
• fix: don't crash on a closing tag with no matching opening tag by @​hdimer in #​861

New Contributors

• @​Wain-PC made their first contribution in #​850
• @​hdimer made their first contribution in #​861

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.1...v5.11.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.