xml

A second root element: SAML signature bypass in passport-saml

An XML signature covers an element, not a file, and passport-saml picked its element two different ways.

found by Felix Wilhelm, Google Project Zero

Namespace separator injection in libexpat (CVE-2022-25236)

libexpat packed three strings into one buffer with a delimiter you chose, and never checked whether the delimiter turned up in the data.

found by Ivan Fratric, Google Project Zero