High severity7.5NVD Advisory· Published Feb 19, 2026· Updated Aug 12, 2026
CVE-2026-26278
CVE-2026-26278
Description
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by processEntities: false option.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
fast-xml-parsernpm | >= 4.1.3, < 4.5.4 | 4.5.4 |
fast-xml-parsernpm | >= 5.0.0, < 5.3.6 | 5.3.6 |
Affected products
37- cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*Range: >=4.1.3,<5.3.6
- osv-coords35 versionspkg:apk/chainguard/dbgatepkg:apk/chainguard/dbgate-fipspkg:apk/chainguard/jitsucom-jitsu-consolepkg:apk/chainguard/kibana-8.17pkg:apk/chainguard/kibana-8.17-iamguardedpkg:apk/chainguard/kibana-8.19pkg:apk/chainguard/kibana-8.19-bitnamipkg:apk/chainguard/kibana-8.19-iamguardedpkg:apk/chainguard/kibana-9.0pkg:apk/chainguard/kibana-9.0-bitnamipkg:apk/chainguard/kibana-9.0-iamguardedpkg:apk/chainguard/kibana-9.1pkg:apk/chainguard/kibana-9.1-iamguardedpkg:apk/chainguard/kibana-9.2pkg:apk/chainguard/kibana-9.2-iamguardedpkg:apk/chainguard/kibana-9.3pkg:apk/chainguard/kibana-9.3-iamguardedpkg:apk/chainguard/kubeflow-pipelines-frontendpkg:apk/chainguard/langfuse-2-workerpkg:apk/chainguard/langfuse-fips-2-workerpkg:apk/chainguard/librechatpkg:apk/chainguard/prismpkg:apk/chainguard/renovatepkg:apk/chainguard/safpkg:apk/chainguard/tileserver-glpkg:apk/chainguard/tileserver-gl-fipspkg:apk/wolfi/jitsucom-jitsu-consolepkg:apk/wolfi/kubeflow-pipelines-frontendpkg:apk/wolfi/prismpkg:apk/wolfi/renovatepkg:apk/wolfi/safpkg:apk/wolfi/tileserver-glpkg:npm/fast-xml-parserpkg:rpm/opensuse/heroic-games-launcher&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/velociraptor&distro=openSUSE%20Tumbleweed
< 7.0.6-r1+ 34 more
- (no CPE)range: < 7.0.6-r1
- (no CPE)range: < 7.1.0-r0
- (no CPE)range: < 2.11.0-r15
- (no CPE)range: < 8.17.10-r10
- (no CPE)range: < 8.17.10-r10
- (no CPE)range: < 8.19.11-r1
- (no CPE)range: < 8.19.11-r1
- (no CPE)range: < 8.19.11-r1
- (no CPE)range: < 9.0.8-r10
- (no CPE)range: < 9.0.8-r10
- (no CPE)range: < 9.0.8-r10
- (no CPE)range: < 9.1.10-r5
- (no CPE)range: < 9.1.10-r5
- (no CPE)range: < 9.2.5-r3
- (no CPE)range: < 9.2.5-r3
- (no CPE)range: < 9.3.0-r1
- (no CPE)range: < 9.3.0-r1
- (no CPE)range: < 2.15.0-r12
- (no CPE)range: < 2.95.12-r11
- (no CPE)range: < 2.95.12-r13
- (no CPE)range: < 0.8.2-r3
- (no CPE)range: < 5.14.3-r7
- (no CPE)range: < 43.48.3-r0
- (no CPE)range: < 1.6.0-r0
- (no CPE)range: < 5.5.0-r5
- (no CPE)range: < 5.5.0-r6
- (no CPE)range: < 2.11.0-r15
- (no CPE)range: < 2.15.0-r12
- (no CPE)range: < 5.14.3-r7
- (no CPE)range: < 43.48.3-r0
- (no CPE)range: < 1.6.0-r0
- (no CPE)range: < 5.5.0-r5
- (no CPE)range: >= 4.1.3, < 4.5.4
- (no CPE)range: < 2.20.0-1.1
- (no CPE)range: < 0.7.0.4.git185.a5708584-2.1
- Range: >= 5.0.0, < 5.3.6
Patches
Vulnerability mechanics
References
16- github.com/NaturalIntelligence/fast-xml-parser/commit/910dae5be2de2955e968558fadf6e8f74f117a77nvdPatchWEB
- github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jmr7-xgp7-cmfjnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-jmr7-xgp7-cmfjghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-26278ghsaADVISORY
- github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.6nvdProductRelease NotesWEB
- access.redhat.com/errata/RHSA-2026:40984nvd
- access.redhat.com/errata/RHSA-2026:41941nvd
- access.redhat.com/errata/RHSA-2026:41944nvd
- access.redhat.com/errata/RHSA-2026:51349nvd
- access.redhat.com/errata/RHSA-2026:6174nvd
- access.redhat.com/errata/RHSA-2026:6802nvd
- access.redhat.com/errata/RHSA-2026:7110nvd
- access.redhat.com/errata/RHSA-2026:7128nvd
- access.redhat.com/security/cve/CVE-2026-26278nvd
- bugzilla.redhat.com/show_bug.cginvd
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26278.jsonnvd
News mentions
0No linked articles in our index yet.