CVE-2026-26278High· 7.5▾ Twilightfast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of e…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.8%
Last analysed / modified upstream
0.8% → 0.9%
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by processEntities: false option.
fast-xml-parser >= 4.1.3, < 5.3.6Upgrade past the affected range:
fast-xml-parser 5.3.6Connected by shared product, vendor, weakness, or advisory.
CVE-2026-25896Critical· 9.3fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback
CVE-2026-29074High· 7.5SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files
GHSA-8r6m-32jq-jx6qHighfast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
CVE-2026-19248High· 7.1QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.
CVE-2026-11573High· 7.1Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase)
CVE-2026-33818High· 7.5Enforce maximum recursion depth in encoding/asn1