unstale

npm / fast-xml-parser

fast-xml-parser

What changed in fast-xml-parser 5, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.

1 breaking7 security1 new APIs and options2 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

fast-xml-parser 511 changes

Breaking changes 1

Security 7

  • fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

    5.10.1security advisory

  • Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser

    5.5.7security advisory

  • fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

    5.5.6security advisory

  • fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

    5.3.8security advisory

  • fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

    5.3.6security advisory

  • fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

    5.3.5security advisory

  • fast-xml-parser has RangeError DoS Numeric Entities Bug

    5.3.4security advisory

New APIs and options 1

  • Node metadata now supports endIndex, allowing developers to access the end index.

    5.11.0release notes

Fixes and other changes 2

  • The version parameter is typed as a number.

    5.11.2release notes

  • The parser no longer crashes when it encounters a closing tag with no matching opening tag.

    5.11.0release notes