Read the docs
TI-2026-22286 Aliases CVE-2026-27942GHSA-fj3w-jwp8-x2g3

fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

Priority LOW 14CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 8 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00543 45th percentileScored 2026-11-07
Fix Partial fast-xml-parser (NaturalIntelligence): 5.3.8fast-xml-parser (npm): 5.3.8, 4.5.4Red Hat: 9 advisoriesRed Hat: 8 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NaturalIntelligencefast-xml-parserbefore 5.3.85.3.8Patch availableCNA
—fast-xml-parser (npm)5.0.0 to before 5.3.85.3.8Patch availableGHSA-fj3w-jwp8-x2g3
—fast-xml-parser (npm)4.0.0-beta.0 to before 4.5.44.5.4Patch availableGHSA-fj3w-jwp8-x2g3
  • fast-xml-parser VendorNaturalIntelligence Affected before 5.3.8 Fixed in 5.3.8 Patch available CNA
  • fast-xml-parser (npm) Vendor— Affected 5.0.0 to before 5.3.8 Fixed in 5.3.8 Patch available GHSA-fj3w-jwp8-x2g3
  • fast-xml-parser (npm) Vendor— Affected 4.0.0-beta.0 to before 4.5.4 Fixed in 4.5.4 Patch available GHSA-fj3w-jwp8-x2g3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*before 4.5.4; 5.0.0 to before 5.3.8VulnerableNaturalIntelligence
  • cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:* Versions before 4.5.4; 5.0.0 to before 5.3.8 Vulnerable ·NaturalIntelligence

Remediation

  • Fix · CNA fast-xml-parser (NaturalIntelligence) Fixed in 5.3.8
  • Fix · GHSA-fj3w-jwp8-x2g3 fast-xml-parser (npm) Fixed in 5.3.8 Advisory →
  • Fix · GHSA-fj3w-jwp8-x2g3 fast-xml-parser (npm) Fixed in 4.5.4 Advisory →

Red Hat 9 advisories

  • RHSA-2026:51349 Released 2026-08-06 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:41944 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.20 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:41941 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.25 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
Show 6 more Red Hat advisories
  • RHSA-2026:40984 Released 2026-07-16 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20.15 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2026:12277 Released 2026-04-30 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20.10 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2026:7128 Released 2026-04-08 · Red Hat rating Important
    RHACS 4.9.5 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
  • RHSA-2026:7110 Released 2026-04-08 · Red Hat rating Important
    RHACS 4.8.10 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
  • RHSA-2026:6802 Released 2026-04-07 · Red Hat rating Important
    Red Hat Developer Hub 1.9.3 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:6174 Released 2026-03-30 · Red Hat rating Important
    Red Hat Developer Hub 1.8.5 release.
    • Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for Applications 8AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Self-service automation portal 2AffectedNo fix yet
Red Hat Advanced Cluster Security 4.8Fixed RHSA-2026:7110
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:7128
Red Hat Developer Hub 1.8Fixed RHSA-2026:6174
Red Hat Developer Hub 1.9Fixed RHSA-2026:6802
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2026:41941
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:41944
Red Hat Openshift Data Foundation 4.20Fixed RHSA-2026:12277, RHSA-2026:40984
Red Hat Satellite 6.18Fixed RHSA-2026:51349
Not affected: 9 products
  • Red Hat Advanced Cluster Security 4.8
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Developer Hub 1.8
  • Red Hat Developer Hub 1.9
  • Red Hat OpenShift Virtualization 4
  • Red Hat Openshift Data Foundation 4.18
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Openshift Data Foundation 4.20
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27942
  2. 2026-10-03 Alias added: GHSA-fj3w-jwp8-x2g3
  3. 2026-10-13 EPSS moved to the 50th–90th percentile
  4. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 2

Advisory 2

Other 1

  • TI-2026-20935 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names CVSS 3.1CRITICAL 9.3
  • TI-2026-25482 fast-xml-parser affected by numeric entity expansion bypassing all entity expansion… CVSS 3.1HIGH 7.5
  • TI-2026-20291 fast-xml-parser has RangeError DoS Numeric Entities Bug CVSS 3.1HIGH 7.5
  • TI-2026-30169 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters CVSS 3.1MEDIUM 6.1
  • TI-2026-25755 fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation CVSS 3.1MEDIUM 5.9
  • TI-2026-21247 fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) CVSS 3.1HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences