CVE-2026-27942

· HIGHAnalyzed

← All CVEs

CVSS v3.1

7.5

CVSS v4.0

2.7

EPSS

0.48%

Published

Feb 25, 2026

Modified

Mar 2, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-120

Affected Products (2)

naturalintelligence · fast-xml-parser (up to 4.5.4)vulnerable

naturalintelligence · fast-xml-parser (up to 5.3.8)vulnerable

References (3)

https://github.com/NaturalIntelligence/fast-xml-parser/commit/c13a961910f14986295dd28484eee830fa1a0e8a

Patch

https://github.com/NaturalIntelligence/fast-xml-parser/pull/791

Issue TrackingPatch

https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-fj3w-jwp8-x2g3

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs