Skip to content

Conversation

@yosefrev
Copy link

@yosefrev yosefrev commented Feb 1, 2026

Fixes GHSA-37qj-frw5-hhjh CVE, which affects versions 4.3.6 through 5.3.3. The vulnerability causes a RangeError when parsing numeric XML entities with out-of-range code points, which affects audit checks.

Fixes #2709

Thank you for opening a Pull Request! Before submitting your PR, there are a few things you can do to make sure it goes smoothly:

Description

Update fast-xml-parser version to ^5.3.4 because of the CVE above

Please provide a detailed description for the change.
As much as possible, please try to keep changes separate by purpose. For example, try not to make a one-line bug fix in a feature request, or add an irrelevant README change to a bug fix.

Impact

What's the impact of this change?
There is a vulnerability in fast-xml-parser when parsing numeric XML entities. I have updated fast-xml-parser from ^4.4.1 to ^5.3.4. This will allow audit checks to succeed.

Testing

Have you added unit and integration tests if necessary? no
Were any tests changed? Are any breaking changes necessary? no

Additional Information

Any additional details that we should be aware of?

Checklist

  • Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
  • Ensure the tests and linter pass
  • Code coverage does not decrease
  • Appropriate docs were updated
  • Appropriate comments were added, particularly in complex areas or places that require background
  • No new warnings or issues will be generated from this change

Fixes #2709 🦕

Fixes GHSA-37qj-frw5-hhjh which affects versions 4.3.6 through 5.3.3.
The vulnerability causes a RangeError when parsing numeric XML entities
with out-of-range code points.

Fixes googleapis#2709
@yosefrev yosefrev requested review from a team as code owners February 1, 2026 00:13
@google-cla
Copy link

google-cla bot commented Feb 1, 2026

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@product-auto-label product-auto-label bot added size: xs Pull request size is extra small. api: storage Issues related to the googleapis/nodejs-storage API. labels Feb 1, 2026
@ddelgrosso1 ddelgrosso1 added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Feb 2, 2026
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Feb 2, 2026
@ddelgrosso1 ddelgrosso1 added the owlbot:run Add this label to trigger the Owlbot post processor. label Feb 2, 2026
@gcf-owl-bot gcf-owl-bot bot removed the owlbot:run Add this label to trigger the Owlbot post processor. label Feb 2, 2026
@ddelgrosso1 ddelgrosso1 added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Feb 2, 2026
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Feb 2, 2026
@ddelgrosso1 ddelgrosso1 added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Feb 2, 2026
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Feb 2, 2026
@chrstrock
Copy link

What needs to happen to get this merged?

@Pulkit0110 Pulkit0110 added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Feb 3, 2026
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Feb 3, 2026
@Pulkit0110
Copy link
Member

What needs to happen to get this merged?

Currently the samples test and system test are failing. Once these are fixed, you'll be able to merge the PR. We're working on fixing the tests, I'll let you know once the tests are fixed.

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

api: storage Issues related to the googleapis/nodejs-storage API. size: xs Pull request size is extra small.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Security vulnerability with fast-xml-parser dependency

9 participants