fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.

Affected: npm: fast-xml-parser

### Impact As a part of this vulnerability, user was able to se code using `__proto__` as a tag or attribute name.

```js const { XMLParser, XMLBuilder, XMLValidator} = require("fast-xml-parser");

let XMLdata = "<__proto__><polluted>hacked</polluted></__proto__>"

const parser = new XMLParser(); let jObj = parser.parse(XMLdata);

console.log(jObj.polluted) // should return hacked ```

### Patches The problem has been patched in v4.1.2

### Workarounds User can check for "__proto__" in the XML string before parsing it to the parser.

### References https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7

Affected: Ubuntu:24.04:LTS: node-webfont, Ubuntu:25.10: node-webfont, Ubuntu:26.04:LTS: node-webfont

fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.