---
id: CVE-2026-26278
title: >-
  fast-xml-parser allows users to validate XML, parse XML to JS object, or build
  XML from JS object without C/C++ based libraries and no callback
summary: >-
  fast-xml-parser allows users to validate XML, parse XML to JS object, or build
  XML from JS object without C/C++ based libraries and no callback. In versions
  4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of
  e…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-776
vendor: naturalintelligence
product: fast-xml-parser
affected:
  - 'fast-xml-parser >= 4.1.3, < 5.3.6'
patched:
  - fast-xml-parser 5.3.6
published: '2026-02-19'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T13:17:56.203'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-26278'
references:
  - url: >-
      https://github.com/NaturalIntelligence/fast-xml-parser/commit/910dae5be2de2955e968558fadf6e8f74f117a77
    label: security-advisories@github.com
  - url: 'https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.6'
    label: security-advisories@github.com
  - url: >-
      https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jmr7-xgp7-cmfj
    label: security-advisories@github.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:40984'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:41941'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:41944'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:51349'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:6174'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:6802'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:7110'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:7128'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2026-26278'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2441120'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26278.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-26278'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-26278'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-02-19T20:58:40.378859Z'
epss: 0.00968
epssPercentile: 0.60234
ingestedAt: '2026-07-16T12:53:55.607Z'
---

## Overview

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.

## Affected

- `fast-xml-parser >= 4.1.3, < 5.3.6`

## Remediation

Upgrade past the affected range:

- `fast-xml-parser 5.3.6`

## Vendor advisories

- **RHSA-2026:7110** · Red Hat · fixed in: Red Hat Advanced Cluster Security 4.8 · released 2026-04-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:7110)
- **RHSA-2026:7128** · Red Hat · fixed in: Red Hat Advanced Cluster Security 4.9 · released 2026-04-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:7128)
- **RHSA-2026:6174** · Red Hat · fixed in: Red Hat Developer Hub 1.8 · released 2026-03-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:6174)
- **RHSA-2026:6802** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-04-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:6802)
- **RHSA-2026:41941** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.18 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41941)
- **RHSA-2026:41944** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.19 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41944)
- **RHSA-2026:40984** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.20 · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:40984)
- **RHSA-2026:51349** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51349)
- **Red Hat VEX** · Important · affected: Migration Toolkit for Applications 8, Red Hat OpenShift GitOps, Red Hat OpenShift Virtualization 4, Self-service automation portal 2 · no fix planned: Red Hat OpenShift GitOps, Migration Toolkit for Applications 8, Red Hat OpenShift Virtualization 4, Self-service automation portal 2 · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26278.json)