CVE-2024-41818: fast-xml-parser ReDOS at currency parsing
Summary
CVE-2024-41818: fast-xml-parser vulnerable to ReDOS at currency parsing. Affects fast-xml-parser versions >= 4.3.5, < 4.4.1. Fixed in 4.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fast-xml-parser is an open-source library for parsing XML data in JavaScript. It provides a fast and efficient way to parse XML documents and extract data from them. The library is widely used in various applications and projects that require XML parsing functionality. However, a vulnerability has been discovered in the experimental version 5 of fast-xml-parser, specifically in the currency parsing module.
Vulnerability Detail
The vulnerability in fast-xml-parser's currency parsing module allows for a Regular Expression Denial of Service (ReDOS) attack. The vulnerable regular expression in the currency.js file can be exploited by an attacker to cause a denial of service by providing a specially crafted input. This can lead to the application becoming unresponsive or crashing during currency parsing. The impact of this vulnerability is a potential disruption of service for applications using the affected version of fast-xml-parser.
How To Fix
Latest published version: 5.11.2 as of 23 Oct 2026
npm install fast-xml-parser@5.11.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.4.1
This is the first release that contains the fix.
npm install fast-xml-parser@4.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the fast-xml-parser library to the latest version as soon as possible.
Conclusion
The vulnerability in fast-xml-parser's currency parsing module can be exploited to cause a denial of service in applications using the affected version. It is crucial to update the fast-xml-parser library to version 4.4.1 or later to mitigate this vulnerability and ensure the security of the application.
See every vulnerability recorded for fast-xml-parser →
FAQ
fast-xml-parser is an open-source library for parsing XML data in JavaScript. It provides a fast and efficient way to parse XML documents and extract data from them.
The vulnerability can lead to a denial of service in applications using the affected version of fast-xml-parser. This can result in the application becoming unresponsive or crashing during currency parsing.
To fix this vulnerability, update fast-xml-parser to version 4.4.1 or later. This version includes a fix for the ReDOS vulnerability in the currency parsing module.
There is no known workaround for this vulnerability. It is recommended to update the fast-xml-parser library to the latest version.
More information about this vulnerability can be found at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-mpg4-rc92-vx8v/GHSA-mpg4-rc92-vx8v.json
References
Related vulnerabilities
Recent vulnerabilities recorded for fast-xml-parser.
