Bundled fast-xml-parser in data-construct and graphql-api-construct causes critical npm audit vulnerabilities

[jpdevrzmz]

Description

The latest versions of @aws-amplify/data-construct@1.17.0 and @aws-amplify/graphql-api-construct@1.21.0 bundle fast-xml-parser@4.4.1, which has three known vulnerabilities:

• GHSA-m7jm-9gc2-mpf2 (Critical) — Entity encoding bypass via regex injection in DOCTYPE entity names
• GHSA-jmr7-xgp7-cmfj (Critical) — DoS through entity expansion in DOCTYPE (no expansion limit)
• GHSA-fj3w-jwp8-x2g3 (High) — Stack overflow in XMLBuilder with preserveOrder

The fix is fast-xml-parser@>=4.5.4.

Because these are bundled dependencies, consumers cannot resolve them via npm overrides or npm audit fix.

Steps to reproduce

mkdir amplify-audit-test && cd amplify-audit-test
npm init -y
npm install @aws-amplify/backend@latest
npm audit

Result

40 vulnerabilities (5 low, 1 moderate, 15 high, 19 critical)

Vulnerable packages found bundled inside data-construct and graphql-api-construct:

Package	Bundled Version	Fixed Version	Severity
fast-xml-parser	4.4.1	>=4.5.4	Critical/High
minimatch	10.0.0–10.2.2	>=10.2.3	High
lodash	4.0.0–4.17.21	>=4.17.22	Moderate
@smithy/config-resolver	<4.4.0	>=4.4.0	Low

Expected behavior

Bundled dependencies should be updated to versions without known vulnerabilities. In particular, fast-xml-parser should be updated to >=4.5.4.

Environment

• @aws-amplify/backend: 1.21.0 (latest as of 2026-03-03)
• @aws-amplify/data-construct: 1.17.0 (latest)
• @aws-amplify/graphql-api-construct: 1.21.0 (latest)
• fast-xml-parser (bundled): 4.4.1
• npm: 11.x
• Node: 24.x

[diorisarias-web]

Confirming this issue persists as of June 2026 — and has escalated with a newer CVE

We are also affected by this issue and can confirm it has not been resolved in the latest published versions.

---

Current state (tested June 2026)

Package	Latest version	Bundled fast-xml-parser	Required fix
@aws-amplify/data-construct	1.17.3	5.5.2	>= 5.7.0
@aws-amplify/graphql-api-construct	1.21.3	5.5.2	>= 5.7.0

Three patch releases were published for each package after this issue was opened (1.17.1, 1.17.2, 1.17.3 / 1.21.1, 1.21.2, 1.21.3) without addressing the bundled dependency.

---

In addition to the CVEs originally reported here, a newer vulnerability has been disclosed:

• CVE-2026-25896 — CVSS 9.3 (Critical): Entity encoding bypass via regex wildcard in DOCTYPE entity names. Requires fast-xml-parser >= 5.7.0.

---

Our lock file confirms all affected instances carry "inBundle": true, which means npm overrides cannot reach them regardless of how they are scoped:

// package-lock.json (inBundle: true on all entries below)
"node_modules/@aws-amplify/data-construct/node_modules/fast-xml-parser": "5.5.2"
"node_modules/@aws-amplify/data-construct/node_modules/@aws-sdk/core/node_modules/fast-xml-parser": "4.4.1"
"node_modules/@aws-amplify/graphql-api-construct/node_modules/fast-xml-parser": "5.5.2"
"node_modules/@aws-amplify/graphql-api-construct/node_modules/@aws-sdk/core/node_modules/fast-xml-parser": "4.4.1"

We have exhausted all consumer-side mitigations — overrides scoped to @aws-amplify/backend, @aws-amplify/storage, and @aws-amplify/backend-cli. None reach the bundled copies inside these construct packages.

Could the team provide an ETA for a release of @aws-amplify/data-construct and @aws-amplify/graphql-api-construct that bundles fast-xml-parser >= 5.7.0?

This is currently the only remaining blocker for our security remediation cycle. Dependabot continues to flag these as Critical with no available fix on the consumer side.