Skip to content
Fencer Vulns
high 7.5

CVE-2023-34104 json

Regex Injection via Doctype Entities

published 2023-06-06 3 y ago modified 2026-06-17 4 mo ago also GHSA-6w63-h3fj-q4vw , EUVD-2023-1717

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denial of service (DoS) attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time. This problem has been resolved in v4.2.4. Users are advised to upgrade. Users unable to upgrade should avoid using DOCTYPE parsing by setting the `processEntities: false` option.

Patch / fix

  • npm fast-xml-parser 4.2.4
  • naturalintelligence fast-xml-parser 4.2.4

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-34104 updated cvss 7.5

fast-xml-parser: Regex Injection via Doctype Entities

  • Red Hat OpenShift Serverless org.kie.kogito-kogito-apps org.kie.kogito-kogito-apps Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9
    affected: no fix available
  • Red Hat MTA 6.2 for RHEL 8 mta/mta-ui-rhel9 6.2.0-17
    fixed: vendor fix RHSA-2023:4627
  • Red Hat MTA 6.2 for RHEL 8 mta/mta-hub-rhel9 6.2.0-16, mta/mta-rhel8-operator 6.2.0-12, mta/mta-operator-bundle 6.2.0-29, mta/mta-pathfinder-rhel9 6.2.0-5, mta/mta-windup-addon-rhel9 6.2.0-11
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.13% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm fast-xml-parser
>=4.1.3, <4.2.4
4.2.4

Affected products

  • NaturalIntelligence fast-xml-parser

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-1333 Inefficient Regular Expression Complexity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.