Kurz gesagt
- CVE-2026-27942 ist eine Schwachstelle (HOCH (CVSS 7.5)) in fast-xml-parser (naturalintelligence), fast-xml-parser.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.54%, höher als bei 45.6% aller Schwachstellen.
- Abhilfe: auf 5.3.8, 4.5.4 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| fast-xml-parser | ≥ 5.0.0, < 5.3.8< 4.5.4
| 5.3.84.5.4
|
| fast-xml-parser npm | ≥ 4.0.0-beta.0, < 4.5.4≥ 5.0.0, < 5.3.8
| 4.5.45.3.8
|
Description
Impact
Application crashes with stack overflow when user use XML builder with prserveOrder:true for following or similar input
[{
'foo': [
{ 'bar': [{ '@_V': 'baz' }] }
]
}]
Cause: arrToStr was not validating if the input is an array or a string and treating all non-array values as text content.
What kind of vulnerability is it? Who is impacted?
Patches
Yes in 5.3.8
Workarounds
Use XML builder with preserveOrder:false or check the input data before passing to builder.
References
Are there any links users can visit to find out more?
NVD description
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free