Vulnerability Description
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Naturalintelligence | Fast-Xml-Parser | < 4.5.4 |
Related Weaknesses (CWE)
References
- https://github.com/NaturalIntelligence/fast-xml-parser/commit/c13a961910f1498629Patch
- https://github.com/NaturalIntelligence/fast-xml-parser/pull/791Issue TrackingPatch
- https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-Vendor Advisory
FAQ
What is CVE-2026-27942?
CVE-2026-27942 is a vulnerability with a CVSS score of 7.5 (HIGH). fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with st...
How severe is CVE-2026-27942?
CVE-2026-27942 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-27942?
Check the references section above for vendor advisories and patch information. Affected products include: Naturalintelligence Fast-Xml-Parser.