{
  "@id": "urn:uuid:ded1ce5c-48f2-4d30-97e1-95177d2f5e10",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T21:21:03.254093+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.19.0",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.19.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-26920 affects version 3.19.0 of fast-xml-parser, and is fixed in 3.19.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2023-26920"
      },
      "action_statement": "Vulnerability CVE-2023-26920 affects version 3.19.0 of fast-xml-parser, and is fixed in 3.19.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.19.0",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.19.0"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2023-34104 affects version 3.19.0 of fast-xml-parser.",
      "vulnerability": {
        "name": "CVE-2023-34104"
      },
      "action_statement": "Vulnerability CVE-2023-34104 affects version 3.19.0 of fast-xml-parser."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.19.0",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.19.0"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2024-41818 affects version 3.19.0 of fast-xml-parser.",
      "vulnerability": {
        "name": "CVE-2024-41818"
      },
      "action_statement": "Vulnerability CVE-2024-41818 affects version 3.19.0 of fast-xml-parser."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.19.0",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.19.0"
          }
        }
      ],
      "timestamp": "2026-11-10T21:21:03.254093+00:00",
      "status_notes": "Vulnerability CVE-2026-126066 does not affect version 3.19.0 of fast-xml-parser. not_affected \u2014 fast-xml-parser 3.19.0 has no OrderedObjParser, readStopNodeData or readTagExp. Stop nodes are handled in the single main loop in src/xmlstr2xmlnode.js. A failed '>' lookahead there throws on the first attempt, so there is no retry loop and no quadratic rescanning of the remaining input.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-126066"
      },
      "impact_statement": "not_affected \u2014 fast-xml-parser 3.19.0 has no OrderedObjParser, readStopNodeData or readTagExp. Stop nodes are handled in the single main loop in src/xmlstr2xmlnode.js. A failed '>' lookahead there throws on the first attempt, so there is no retry loop and no quadratic rescanning of the remaining input."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.19.0",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.19.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25128 does not affect version 3.19.0 of fast-xml-parser. Version 3.19.0 is not affected by CVE-2026-25128. The vulnerability exists in versions 5.0.9 through 5.3.3 where the OrderedObjParser class processes numeric HTML entities using String.fromCodePoint() without validating that code points are within the valid Unicode range (0 to 0x10FFFF). Version 3.19.0 uses a fundamentally different architecture that does not process entities - they remain as literal strings in the parser output. Testing confirms that out-of-range entities like � and � do not cause crashes and are preserved unchanged in the output.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-25128"
      },
      "impact_statement": "Version 3.19.0 is not affected by CVE-2026-25128. The vulnerability exists in versions 5.0.9 through 5.3.3 where the OrderedObjParser class processes numeric HTML entities using String.fromCodePoint() without validating that code points are within the valid Unicode range (0 to 0x10FFFF). Version 3.19.0 uses a fundamentally different architecture that does not process entities - they remain as literal strings in the parser output. Testing confirms that out-of-range entities like � and � do not cause crashes and are preserved unchanged in the output."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.19.0",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.19.0"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2026-25896 affects version 3.19.0 of fast-xml-parser.",
      "vulnerability": {
        "name": "CVE-2026-25896"
      },
      "action_statement": "Vulnerability CVE-2026-25896 affects version 3.19.0 of fast-xml-parser."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.19.0",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.19.0"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2026-26278 affects version 3.19.0 of fast-xml-parser.",
      "vulnerability": {
        "name": "CVE-2026-26278"
      },
      "action_statement": "Vulnerability CVE-2026-26278 affects version 3.19.0 of fast-xml-parser."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.19.0",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.19.0"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2026-27942 affects version 3.19.0 of fast-xml-parser.",
      "vulnerability": {
        "name": "CVE-2026-27942"
      },
      "action_statement": "Vulnerability CVE-2026-27942 affects version 3.19.0 of fast-xml-parser."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.19.0",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.19.0"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2026-33036 affects version 3.19.0 of fast-xml-parser.",
      "vulnerability": {
        "name": "CVE-2026-33036"
      },
      "action_statement": "Vulnerability CVE-2026-33036 affects version 3.19.0 of fast-xml-parser."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.19.0",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.19.0"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2026-33349 affects version 3.19.0 of fast-xml-parser.",
      "vulnerability": {
        "name": "CVE-2026-33349"
      },
      "action_statement": "Vulnerability CVE-2026-33349 affects version 3.19.0 of fast-xml-parser."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.19.0",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.19.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41650 affects version 3.19.0 of fast-xml-parser, and is fixed in 3.19.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-41650"
      },
      "action_statement": "Vulnerability CVE-2026-41650 affects version 3.19.0 of fast-xml-parser, and is fixed in 3.19.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.19.0",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.19.0"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2026-73569 affects version 3.19.0 of fast-xml-parser.",
      "vulnerability": {
        "name": "CVE-2026-73569"
      },
      "action_statement": "Vulnerability CVE-2026-73569 affects version 3.19.0 of fast-xml-parser."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-xml-parser@3.19.0",
          "identifiers": {
            "purl": "pkg:npm/fast-xml-parser@3.19.0"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability GHSA-gpv5-7x3g-ghjv affects version 3.19.0 of fast-xml-parser.",
      "vulnerability": {
        "name": "GHSA-gpv5-7x3g-ghjv"
      },
      "action_statement": "Vulnerability GHSA-gpv5-7x3g-ghjv affects version 3.19.0 of fast-xml-parser."
    }
  ]
}