En resumen
- CVE-2026-27942 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a fast-xml-parser (naturalintelligence), fast-xml-parser.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.54%, mayor que el 45.6% de las vulnerabilidades.
- Solución: actualizar a 5.3.8, 4.5.4 o posterior.
| Package | Affected versions | Patched versions |
|---|
| fast-xml-parser | ≥ 5.0.0, < 5.3.8< 4.5.4
| 5.3.84.5.4
|
| fast-xml-parser npm | ≥ 4.0.0-beta.0, < 4.5.4≥ 5.0.0, < 5.3.8
| 4.5.45.3.8
|
Description
Impact
Application crashes with stack overflow when user use XML builder with prserveOrder:true for following or similar input
[{
'foo': [
{ 'bar': [{ '@_V': 'baz' }] }
]
}]
Cause: arrToStr was not validating if the input is an array or a string and treating all non-array values as text content.
What kind of vulnerability is it? Who is impacted?
Patches
Yes in 5.3.8
Workarounds
Use XML builder with preserveOrder:false or check the input data before passing to builder.
References
Are there any links users can visit to find out more?
NVD description
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free