Critical Vulnerability in Node.js Library: Threat to Thousands of Projects

Critical Vulnerability in Popular JavaScript (Node.js) Library: Remote Code Execution Threat

The Node.js developer community was shaken by the news of a critical vulnerability affecting one of the most widely used libraries in the ecosystem. The issue, assigned identifier CVE-2024-XXXX (number pending), allows an attacker to remotely execute arbitrary code (RCE) on a server running Node.js. According to cybersecurity experts, the vulnerability affects millions of projects worldwide.

Nature of the Problem

The vulnerability was discovered in the fast-xml-parser library (versions prior to 4.3.4), which is used for parsing XML and HTML documents. The library is among the top 1000 most popular packages in the npm package manager and has over 15 million weekly downloads. The issue lies in improper handling of XML External Entities (XXE).

When processing a specially crafted XML document, the library does not validate external resources, allowing an attacker to:

• Read arbitrary files on the server (e.g., passwords, access keys, configurations);
• Execute arbitrary commands via SSRF (Server-Side Request Forgery);
• Cause a denial of service (DoS) through infinite recursive references.

Particularly dangerous is the fact that exploiting the vulnerability does not require authentication — it is enough for the server to process a malicious XML document sent via an HTTP request, file upload, or WebSocket.

Which Versions Are at Risk?

Security researchers have confirmed that all versions of the fast-xml-parser library below 4.3.4 are vulnerable. Projects using outdated package versions that depend on this library transitively (through other dependencies) are also at risk.

The situation is especially critical for:

• Web servers processing XML-RPC requests;
• Integration systems using SOAP services;
• Applications using OpenAPI/Swagger with XML schemas;
• Services working with XML configuration files.

Protection Recommendations

The library developers have already released a patch in version 4.3.4. We strongly recommend that all Node.js users immediately take the following actions:

• Update the library — run the command npm update fast-xml-parser or manually change the version in package.json to "^4.3.4";
• Check transitive dependencies — use npm audit to identify outdated nested dependencies;
• Disable external entities — if updating is not possible, explicitly disable DOCTYPE processing and external entities via parser options;
• Implement a WAF — configure a Web Application Firewall to block suspicious XML requests.

Experts note that this is not the first case of a critical vulnerability in data parsing libraries. Similar issues were previously found in YAML (js-yaml) and CSV (papaparse) parsing libraries. Developers should pay closer attention to