Read the docs
TI-2026-21247 Aliases CVE-2026-26278GHSA-jmr7-xgp7-cmfj

fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

Priority MEDIUM 41CWE-776Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 8 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00937 61st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial fast-xml-parser (NaturalIntelligence): 5.3.6, 4.5.4fast-xml-parser (npm): 4.5.4, 5.3.6Red Hat: 8 advisoriesRed Hat: 8 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NaturalIntelligencefast-xml-parser5.0.0 to before 5.3.6; 4.1.3 to before 4.5.45.3.6, 4.5.4Patch availableCNA
—fast-xml-parser (npm)4.1.3 to before 4.5.44.5.4Patch availableGHSA-jmr7-xgp7-cmfj
—fast-xml-parser (npm)5.0.0 to before 5.3.65.3.6Patch availableGHSA-jmr7-xgp7-cmfj
  • fast-xml-parser VendorNaturalIntelligence Affected 5.0.0 to before 5.3.6; 4.1.3 to before 4.5.4 Fixed in 5.3.6, 4.5.4 Patch available CNA
  • fast-xml-parser (npm) Vendor— Affected 4.1.3 to before 4.5.4 Fixed in 4.5.4 Patch available GHSA-jmr7-xgp7-cmfj
  • fast-xml-parser (npm) Vendor— Affected 5.0.0 to before 5.3.6 Fixed in 5.3.6 Patch available GHSA-jmr7-xgp7-cmfj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*4.1.3 to before 5.3.6VulnerableNaturalIntelligence
  • cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:* Versions 4.1.3 to before 5.3.6 Vulnerable ·NaturalIntelligence

Remediation

  • Fix · CNA fast-xml-parser (NaturalIntelligence) Fixed in 5.3.6, 4.5.4
  • Fix · GHSA-jmr7-xgp7-cmfj fast-xml-parser (npm) Fixed in 4.5.4 Advisory →
  • Fix · GHSA-jmr7-xgp7-cmfj fast-xml-parser (npm) Fixed in 5.3.6 Advisory →

Red Hat 8 advisories

  • RHSA-2026:51349 Released 2026-08-06 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:41944 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.20 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:41941 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.25 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
Show 5 more Red Hat advisories
  • RHSA-2026:40984 Released 2026-07-16 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20.15 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2026:7128 Released 2026-04-08 · Red Hat rating Important
    RHACS 4.9.5 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
  • RHSA-2026:7110 Released 2026-04-08 · Red Hat rating Important
    RHACS 4.8.10 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
  • RHSA-2026:6802 Released 2026-04-07 · Red Hat rating Important
    Red Hat Developer Hub 1.9.3 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:6174 Released 2026-03-30 · Red Hat rating Important
    Red Hat Developer Hub 1.8.5 release.
    • Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for Applications 8AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Self-service automation portal 2AffectedNo fix yet
Red Hat Advanced Cluster Security 4.8Fixed RHSA-2026:7110
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:7128
Red Hat Developer Hub 1.8Fixed RHSA-2026:6174
Red Hat Developer Hub 1.9Fixed RHSA-2026:6802
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2026:41941
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:41944
Red Hat Openshift Data Foundation 4.20Fixed RHSA-2026:40984
Red Hat Satellite 6.18Fixed RHSA-2026:51349
Not affected: 8 products
  • Red Hat Advanced Cluster Security 4.8
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Developer Hub 1.8
  • Red Hat Developer Hub 1.9
  • Red Hat Openshift Data Foundation 4.18
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Openshift Data Foundation 4.20
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-26278
  2. 2026-10-03 Alias added: GHSA-jmr7-xgp7-cmfj

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-20935 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names CVSS 3.1CRITICAL 9.3
  • TI-2026-25482 fast-xml-parser affected by numeric entity expansion bypassing all entity expansion… CVSS 3.1HIGH 7.5
  • TI-2026-20291 fast-xml-parser has RangeError DoS Numeric Entities Bug CVSS 3.1HIGH 7.5
  • TI-2026-30169 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters CVSS 3.1MEDIUM 6.1
  • TI-2026-25755 fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation CVSS 3.1MEDIUM 5.9
  • TI-2024-27861 ReDOS at currency parsing fast-xml-parser CVSS 3.1HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences