CVE-2026-26278
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
A vulnerability in the fast-xml-parser library allows a DoS attack via unlimited entity expansion. Even a small XML file can cause prolonged processing and freeze the application.
Risk Assessment
An attacker can send a specially crafted XML document, causing significant slowdown or complete application freeze, leading to denial of service (DoS).
Recommendation
Immediately update the fast-xml-parser library to version 5.3.6 or later. If an update is not possible, disable DOCTYPE parsing using the `processEntities: false` option.
Other vulnerabilities in fast-xml-parser
See all- CVE-2026-25896Critical
In fast-xml-parser versions 4.1.3 through before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered.
- CVE-2026-73569High
fast-xml-parser versions 5.9.3 through 5.10.1 have a vulnerability related to processing multiple DOCTYPE declarations in a single XML document. The addInputEntities() function resets entity expansion limits on each call, allowing bypass of protections and potentially causing excessive CPU usage, event-loop blocking, memory exhaustion, and process termination. The issue is fixed in version 5.10.1.
- CVE-2023-34104High
fast-xml-parser is an open source, pure JavaScript XML parser that allows special characters in entity names, which are not properly escaped. An attacker can exploit this vulnerability to perform denial of service (DoS) attacks by crafting entity names that generate inefficient regular expressions.
Original NVD description (English source)
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.