# What changed in fast-xml-parser

> 11 changes in fast-xml-parser 5 from its official release notes, upgrade guides and advisories: 1 breaking, 7 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/fast-xml-parser/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## fast-xml-parser 5

### Breaking changes

- Uint8Array XML input is decoded as UTF-8. (5.11.2) — [release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.11.2)

### Security

- fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits (5.10.1) — [security advisory](https://github.com/advisories/GHSA-8R6M-32JQ-JX6Q)
- Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser (5.5.7) — [security advisory](https://github.com/advisories/GHSA-JP2Q-39XQ-3W4G)
- fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) (5.5.6) — [security advisory](https://github.com/advisories/GHSA-8GC5-J5RX-235R)
- fast-xml-parser has stack overflow in XMLBuilder with preserveOrder (5.3.8) — [security advisory](https://github.com/advisories/GHSA-FJ3W-JWP8-X2G3)
- fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) (5.3.6) — [security advisory](https://github.com/advisories/GHSA-JMR7-XGP7-CMFJ)
- fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names (5.3.5) — [security advisory](https://github.com/advisories/GHSA-M7JM-9GC2-MPF2)
- fast-xml-parser has RangeError DoS Numeric Entities Bug (5.3.4) — [security advisory](https://github.com/advisories/GHSA-37QJ-FRW5-HHJH)

### New APIs and options

- Node metadata now supports endIndex, allowing developers to access the end index. (5.11.0) — [release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.11.0)

### Fixes and other changes

- The version parameter is typed as a number. (5.11.2) — [release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.11.2)
- The parser no longer crashes when it encounters a closing tag with no matching opening tag. (5.11.0) — [release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.11.0)