{
  "@id": "urn:uuid:b2ecd139-f768-466f-ab53-ad0d4c00c733",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T21:20:53.606262+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.17.5",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.17.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-26920 affects version 3.17.5 of fast-xml-parser, and is fixed in 3.17.5-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2023-26920"
      },
      "action_statement": "Vulnerability CVE-2023-26920 affects version 3.17.5 of fast-xml-parser, and is fixed in 3.17.5-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.17.5",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.17.5"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2023-34104 affects version 3.17.5 of fast-xml-parser.",
      "vulnerability": {
        "name": "CVE-2023-34104"
      },
      "action_statement": "Vulnerability CVE-2023-34104 affects version 3.17.5 of fast-xml-parser."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.17.5",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.17.5"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2024-41818 affects version 3.17.5 of fast-xml-parser.",
      "vulnerability": {
        "name": "CVE-2024-41818"
      },
      "action_statement": "Vulnerability CVE-2024-41818 affects version 3.17.5 of fast-xml-parser."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.17.5",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.17.5"
          }
        }
      ],
      "timestamp": "2026-11-10T21:20:53.606262+00:00",
      "status_notes": "Vulnerability CVE-2026-126066 does not affect version 3.17.5 of fast-xml-parser. not_affected \u2014 fast-xml-parser 3.17.5 has no readStopNodeData()/readTagExp() retry loop. Its stopNodes handling sits in the single-pass getTraversalObj() in src/xmlstr2xmlnode.js. When no closing '>' exists, closingIndexForOpeningTag() scans once and returns undefined, and the next line throws a TypeError at once. The scan is never retried per '<', so the O(n^2) rescan does not occur.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-126066"
      },
      "impact_statement": "not_affected \u2014 fast-xml-parser 3.17.5 has no readStopNodeData()/readTagExp() retry loop. Its stopNodes handling sits in the single-pass getTraversalObj() in src/xmlstr2xmlnode.js. When no closing '>' exists, closingIndexForOpeningTag() scans once and returns undefined, and the next line throws a TypeError at once. The scan is never retried per '<', so the O(n^2) rescan does not occur."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.17.5",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.17.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25128 does not affect version 3.17.5 of fast-xml-parser. Version 3.17.5-tuxcare.1 is not affected by CVE-2026-25128. The vulnerability requires numeric entity processing code that calls String.fromCodePoint() with out-of-range values, causing a RangeError crash. This version lacks the entity processing architecture entirely - it has no OrderedObjParser.js file, no String.fromCodePoint usage, and no entity conversion logic. XML numeric entities (e.g., &#9999999;) remain as literal strings in the parsed output rather than being converted to characters. The vulnerable code path introduced in version 5.x does not exist in the version 3.x codebase architecture.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-25128"
      },
      "impact_statement": "Version 3.17.5-tuxcare.1 is not affected by CVE-2026-25128. The vulnerability requires numeric entity processing code that calls String.fromCodePoint() with out-of-range values, causing a RangeError crash. This version lacks the entity processing architecture entirely - it has no OrderedObjParser.js file, no String.fromCodePoint usage, and no entity conversion logic. XML numeric entities (e.g., &#9999999;) remain as literal strings in the parsed output rather than being converted to characters. The vulnerable code path introduced in version 5.x does not exist in the version 3.x codebase architecture."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.17.5",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.17.5"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2026-25896 affects version 3.17.5 of fast-xml-parser.",
      "vulnerability": {
        "name": "CVE-2026-25896"
      },
      "action_statement": "Vulnerability CVE-2026-25896 affects version 3.17.5 of fast-xml-parser."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.17.5",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.17.5"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2026-26278 affects version 3.17.5 of fast-xml-parser.",
      "vulnerability": {
        "name": "CVE-2026-26278"
      },
      "action_statement": "Vulnerability CVE-2026-26278 affects version 3.17.5 of fast-xml-parser."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.17.5",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.17.5"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2026-27942 affects version 3.17.5 of fast-xml-parser.",
      "vulnerability": {
        "name": "CVE-2026-27942"
      },
      "action_statement": "Vulnerability CVE-2026-27942 affects version 3.17.5 of fast-xml-parser."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.17.5",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.17.5"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2026-33036 affects version 3.17.5 of fast-xml-parser.",
      "vulnerability": {
        "name": "CVE-2026-33036"
      },
      "action_statement": "Vulnerability CVE-2026-33036 affects version 3.17.5 of fast-xml-parser."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.17.5",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.17.5"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2026-33349 affects version 3.17.5 of fast-xml-parser.",
      "vulnerability": {
        "name": "CVE-2026-33349"
      },
      "action_statement": "Vulnerability CVE-2026-33349 affects version 3.17.5 of fast-xml-parser."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.17.5",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.17.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41650 affects version 3.17.5 of fast-xml-parser, and is fixed in 3.17.5-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-41650"
      },
      "action_statement": "Vulnerability CVE-2026-41650 affects version 3.17.5 of fast-xml-parser, and is fixed in 3.17.5-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.17.5",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.17.5"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2026-73569 affects version 3.17.5 of fast-xml-parser.",
      "vulnerability": {
        "name": "CVE-2026-73569"
      },
      "action_statement": "Vulnerability CVE-2026-73569 affects version 3.17.5 of fast-xml-parser."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.17.5",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.17.5"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability GHSA-gpv5-7x3g-ghjv affects version 3.17.5 of fast-xml-parser.",
      "vulnerability": {
        "name": "GHSA-gpv5-7x3g-ghjv"
      },
      "action_statement": "Vulnerability GHSA-gpv5-7x3g-ghjv affects version 3.17.5 of fast-xml-parser."
    }
  ]
}