CVE-2026-26278: fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
Vulnerability summary
CVE-2026-26278 is a high (CVSS 7.5) vulnerability in naturalintelligence fast-xml-parser. EPSS estimates a 0.94% chance of exploitation in the next 30 days, higher than 60.9% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 3Timeline
- 19-02-2026PublishedVulnerability first disclosed.
- 10-09-2026Last modifiedVulnerability information updated.
Description
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.94%
Chance of exploitation in the next 30 days
Percentile
61%
Versus all other CVEs
30-day change
Decrease -0.03 pp
From 0.97% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundFast Xml Parser
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard30 products
- dbgate< 7.0.6-r1
- dbgate-fips< 7.1.0-r0
- jitsucom-jitsu-console< 2.11.0-r15
- kibana-8.17< 8.17.10-r10
- kibana-8.17-iamguarded< 8.17.10-r10
Wolfi6 products
- jitsucom-jitsu-console< 2.11.0-r15
- kubeflow-pipelines-frontend< 2.15.0-r12
- prism< 5.14.3-r7
- renovate< 43.48.3-r0
- saf< 1.6.0-r0
Debian1 product
- node-webfontAll versions (No fix recorded)
Naturalintelligence1 product
- fast-xml-parser≥ 5.0.0, < 5.3.6 | ≥ 4.1.3, < 4.5.4 | ≥ 4.1.3, < 5.3.6
Npm1 product
- fast-xml-parser≥ 4.1.3, < 4.5.4 | ≥ 5.0.0, < 5.3.6
Ubuntu1 product
- node-webfontAll versions (No fix recorded)
6 vendors · 40 products
References
20 links- github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jmr7-xgp7-cmfjX Refsource CONFIRMREPORTAdvisoryWEBExploitVendor Advisory
- github.com/NaturalIntelligence/fast-xml-parser/commit/910dae5be2de2955e968558fadf6e8f74f117a77X Refsource MISCREPORTFIXWEBPatch
- github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.6X Refsource MISCREPORTWEBProductRelease Notes
