fast-xml-parser 0.8.15: parser quadratic DoS & serializer name-check fixes

Summary of Vulnerability Details Vulnerability Overview Release: Backport security release 0.8.15 (for the 8.9.x LTS branch) Key Issues: - parser/DOM DoS: The parser exhibits several quadratic complexity issues, including memory/prototype chain inheritance, attribute deduplication, trailing whitespace handling, and malformed input recovery. - Serializer Name Checks: When is set, the serializer validates names for DocType, PI target, and EntityReference to prevent XML injection. - End-tag Reporting: The parser accepts non-well-formed end-tags (e.g., followed by content) and reports an in both XML and HTML. Scope of Impact Affected Versions: 8.9.12 and earlier (0.8.x branch) Impact Scenarios: - The parser has multiple quadratic complexity DoS vulnerabilities in the default parsing path (GHSA-865w-775w-m77g, GHSA-8434-89m-596f, GHSA-4f4p-89m-596f, GHSA-4f4p-1954-1254, GHSA-045f-89d-wn6g). - The serializer performs name validation for DocType, PI target, and EntityReference when (GHSA-27gb-2357-5gqy, GHSA-27gb-3c8b-wxgv, GHSA-77gb-3c8b-wxgv, GHSA-4qmp-4qmp-gcnd). - The parser reports non-well-formed end-tags (GHSA-4hdr-4r42-qq99). Fix Details parser/DOM Fixes: - Resolved multiple quadratic complexity issues, including memory/prototype chain inheritance, attribute deduplication, trailing whitespace handling, and malformed input recovery. - Fixed the reporting issue for non-well-formed end-tags. Serializer Fixes: - When , the serializer validates names for DocType, PI target, and EntityReference to prevent XML injection. Testing and Regression: - Each DoS fix includes deterministic complexity regression tests ( ). - Serializer name checks for deferred to the next release (0.8.0) (CWE-407). POC/Exploit Code No POC Code: The page does not contain specific POC or exploit code blocks.

Goal Reached Thanks to every supporter — we hit 100%!

fast-xml-parser 0.8.15: parser quadratic DoS & serializer name-check fixes

More from this source