{"id":"CVE-2026-26278","title":"fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback","summary":"fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of e…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-776"],"vendor":"naturalintelligence","product":"fast-xml-parser","affected":["fast-xml-parser >= 4.1.3, < 5.3.6"],"patched":["fast-xml-parser 5.3.6"],"published":"2026-02-19","updated":"2026-09-10","sourceUpdated":"2026-09-10T13:17:56.203","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-26278","references":[{"url":"https://github.com/NaturalIntelligence/fast-xml-parser/commit/910dae5be2de2955e968558fadf6e8f74f117a77","label":"security-advisories@github.com"},{"url":"https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.6","label":"security-advisories@github.com"},{"url":"https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jmr7-xgp7-cmfj","label":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:40984","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41941","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41944","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:51349","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6174","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6802","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:7110","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:7128","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-26278","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2441120","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26278.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-26278"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26278"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-02-19T20:58:40.378859Z"},"epss":0.00968,"epssPercentile":0.60234,"ingestedAt":"2026-07-16T12:53:55.607Z","slug":"CVE-2026-26278","body":"## Overview\n\nfast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.\n\n## Affected\n\n- `fast-xml-parser >= 4.1.3, < 5.3.6`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `fast-xml-parser 5.3.6`\n\n## Vendor advisories\n\n- **RHSA-2026:7110** · Red Hat · fixed in: Red Hat Advanced Cluster Security 4.8 · released 2026-04-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:7110)\n- **RHSA-2026:7128** · Red Hat · fixed in: Red Hat Advanced Cluster Security 4.9 · released 2026-04-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:7128)\n- **RHSA-2026:6174** · Red Hat · fixed in: Red Hat Developer Hub 1.8 · released 2026-03-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:6174)\n- **RHSA-2026:6802** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-04-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:6802)\n- **RHSA-2026:41941** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.18 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41941)\n- **RHSA-2026:41944** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.19 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41944)\n- **RHSA-2026:40984** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.20 · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:40984)\n- **RHSA-2026:51349** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51349)\n- **Red Hat VEX** · Important · affected: Migration Toolkit for Applications 8, Red Hat OpenShift GitOps, Red Hat OpenShift Virtualization 4, Self-service automation portal 2 · no fix planned: Red Hat OpenShift GitOps, Migration Toolkit for Applications 8, Red Hat OpenShift Virtualization 4, Self-service automation portal 2 · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26278.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}