What’s Vulnerable › Vulnerabilities

CVE-2026-27942: fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-26 · updated 2026-06-17
• Weakness: CWE-120

Description

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder.

Affected products

• NaturalIntelligence fast-xml-parser: before 4.5.4; from 5.0.0 before 5.3.8 — fixed in 4.5.4, 5.3.8

How to fix

Upgrade to a fixed version: NaturalIntelligence fast-xml-parser 4.5.4, 5.3.8. Check the vendor advisory for mitigations.

References

• https://github.com/NaturalIntelligence/fast-xml-parser/commit/c13a961910f14986295dd28484eee830fa1a0e8a
• https://github.com/NaturalIntelligence/fast-xml-parser/pull/791
• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-fj3w-jwp8-x2g3

Get alerted when CVE-2026-27942 or the next vulnerability affects your stack