CVE-2026-26278

216.73.216.6

· Published 19/02/2026 20:25 · Modified 20/02/2026 13:49

Labels: CVE-2026-26278 2026-02-19 CVE-2026-26278 CWE-776 [email protected]

Essential information

Published: 19/02/2026 20:25
Modified: 20/02/2026 13:49
Author: —
Creator: —
CVSS: 7.5 HIGH (v3.1)
CISA KEV: No
CWE: —
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS metrics

Description

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.

NVD status

Status: Undergoing Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
fast-xml-parser / fast-xml-parser	`cpe:2.3:a:fast-xml-parser:fast-xml-parser:4.1.3-5.3.5:::::::*`
fast-xml-parser / fast-xml-parser	`cpe:2.3:a:fast-xml-parser:fast-xml-parser:<5.3.6:::::::*`