{"id":"CVE-2026-26278","aliases":["CLSA-2026-1776818199","CLSA-2026-1781744119","CLSA-2026-1781744139","CLSA-2026-1790597933","CLSA-2026-1792454133","CLSA-2026-1792698537","DEBIAN-CVE-2026-26278","EUVD-2026-7970","GHSA-jmr7-xgp7-cmfj","ROOT-APP-NPM-CVE-2026-26278","UBUNTU-CVE-2026-26278","openSUSE-SU-2026:10236-1","openSUSE-SU-2026:11126-1"],"status":"published","title":"fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)","description":"fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00937,"percentile":0.61328,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-776"],"published":"2026-02-17T21:30:10Z","modified":"2026-11-05T13:28:24Z","fixes":[{"ecosystem":"npm","package":"fast-xml-parser","fixed_in":["4.5.4","5.3.6"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"fast-xml-parser","fixed_in":["4.4.1-aikido.9","5.2.5-aikido.4","5.3.4-aikido.7","5.3.4-aikido.8","4.2.5-aikido.2","4.5.3-aikido.2","4.5.1-aikido.2","4.5.1-aikido.3","4.5.1-aikido.4","5.3.6-aikido.5","5.3.6-aikido.6","4.5.4-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/fast-xml-parser","fixed_in":["5.3.4-root.io.1","5.3.4-root.io.2","5.3.4-root.io.3","4.4.1-root.io.3","4.4.1-root.io.4","5.3.4-root.io.4","4.4.1-root.io.5","4.4.1-root.io.6","4.4.1-root.io.7","5.3.4-root.io.5","5.2.5-root.io.2","4.4.1-root.io.8","5.2.5-root.io.3","5.3.4-root.io.6","4.4.1-root.io.9","5.2.5-root.io.4","5.3.4-root.io.7","5.3.4-root.io.8","4.2.5-root.io.2","4.5.3-root.io.2","4.5.1-root.io.2","4.5.1-root.io.3","4.5.1-root.io.4","5.3.6-root.io.1","5.3.6-root.io.2","5.3.6-root.io.3","5.3.6-root.io.4","5.3.6-root.io.5","5.3.6-root.io.6","4.5.4-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.3"},{"fixed":"4.5.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.3.6"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.3-tuxcare.0"},{"fixed":"4.5.3-tuxcare.2"}]}],"versions":["4.5.3","4.5.3-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.7-tuxcare.0"},{"fixed":"4.2.7-tuxcare.1"}]}],"versions":["4.2.7"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0-tuxcare.0"},{"fixed":"4.4.0-tuxcare.1"}]}],"versions":["4.4.0"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.1-tuxcare.0"},{"fixed":"4.5.1-tuxcare.4"}]}],"versions":["4.5.1","4.5.1-tuxcare.1","4.5.1-tuxcare.2","4.5.1-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.5-tuxcare.0"},{"fixed":"5.2.5-tuxcare.1"}]}],"versions":["5.2.5"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.1-tuxcare.0"},{"fixed":"4.4.1-tuxcare.2"}]}],"versions":["4.4.1","4.4.1-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"node-webfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.4.0+dfsg2+~cs35.7.26-10","11.4.0+dfsg2+~cs35.7.26-11","11.4.0+dfsg2+~cs35.7.26-12","11.4.0+dfsg2+~cs35.7.26-13","11.4.0+dfsg2+~cs35.7.26-14","11.4.0+dfsg2+~cs35.7.26-15","11.4.0+dfsg2+~cs35.7.26-16","11.4.0+dfsg2+~cs35.7.26-18","11.4.0+dfsg2+~cs35.7.26-19","11.4.0+dfsg2+~cs35.7.26-20","11.4.0+dfsg2+~cs35.7.26-21","11.4.0+dfsg2+~cs35.7.26-7","11.4.0+dfsg2+~cs35.7.26-8","11.4.0+dfsg2+~cs35.7.26-9"]},{"source":"osv","ecosystem":"Debian:13","package":"node-webfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.4.0+dfsg2+~cs35.7.26-13","11.4.0+dfsg2+~cs35.7.26-14","11.4.0+dfsg2+~cs35.7.26-15","11.4.0+dfsg2+~cs35.7.26-16","11.4.0+dfsg2+~cs35.7.26-18","11.4.0+dfsg2+~cs35.7.26-19","11.4.0+dfsg2+~cs35.7.26-20","11.4.0+dfsg2+~cs35.7.26-21"]},{"source":"osv","ecosystem":"Debian:14","package":"node-webfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.4.0+dfsg2+~cs35.7.26-13","11.4.0+dfsg2+~cs35.7.26-14","11.4.0+dfsg2+~cs35.7.26-15","11.4.0+dfsg2+~cs35.7.26-16","11.4.0+dfsg2+~cs35.7.26-18","11.4.0+dfsg2+~cs35.7.26-19","11.4.0+dfsg2+~cs35.7.26-20","11.4.0+dfsg2+~cs35.7.26-21"]},{"source":"osv","ecosystem":"npm","package":"fast-xml-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"4.1.3"},{"fixed":"4.5.4"}]}]},{"source":"osv","ecosystem":"npm","package":"fast-xml-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.3.6"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-aikido.9"},{"fixed":"5.2.5-aikido.4"},{"fixed":"5.3.4-aikido.7"},{"fixed":"5.3.4-aikido.8"},{"fixed":"4.2.5-aikido.2"},{"fixed":"4.5.3-aikido.2"},{"fixed":"4.5.1-aikido.2"},{"fixed":"4.5.1-aikido.3"},{"fixed":"4.5.1-aikido.4"},{"fixed":"5.3.6-aikido.5"},{"fixed":"5.3.6-aikido.6"},{"fixed":"4.5.4-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.4-root.io.1"},{"fixed":"5.3.4-root.io.2"},{"fixed":"5.3.4-root.io.3"},{"fixed":"4.4.1-root.io.3"},{"fixed":"4.4.1-root.io.4"},{"fixed":"5.3.4-root.io.4"},{"fixed":"4.4.1-root.io.5"},{"fixed":"4.4.1-root.io.6"},{"fixed":"4.4.1-root.io.7"},{"fixed":"5.3.4-root.io.5"},{"fixed":"5.2.5-root.io.2"},{"fixed":"4.4.1-root.io.8"},{"fixed":"5.2.5-root.io.3"},{"fixed":"5.3.4-root.io.6"},{"fixed":"4.4.1-root.io.9"},{"fixed":"5.2.5-root.io.4"},{"fixed":"5.3.4-root.io.7"},{"fixed":"5.3.4-root.io.8"},{"fixed":"4.2.5-root.io.2"},{"fixed":"4.5.3-root.io.2"},{"fixed":"4.5.1-root.io.2"},{"fixed":"4.5.1-root.io.3"},{"fixed":"4.5.1-root.io.4"},{"fixed":"5.3.6-root.io.1"},{"fixed":"5.3.6-root.io.2"},{"fixed":"5.3.6-root.io.3"},{"fixed":"5.3.6-root.io.4"},{"fixed":"5.3.6-root.io.5"},{"fixed":"5.3.6-root.io.6"},{"fixed":"4.5.4-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-webfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.4.0+dfsg2+~cs35.7.26-7ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-webfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.4.0+dfsg2+~cs35.7.26-10","11.4.0+dfsg2+~cs35.7.26-13ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-webfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.4.0+dfsg2+~cs35.7.26-18","11.4.0+dfsg2+~cs35.7.26-19"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-webfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.4.0+dfsg2+~cs35.7.26-13ubuntu2","11.4.0+dfsg2+~cs35.7.26-14","11.4.0+dfsg2+~cs35.7.26-15","11.4.0+dfsg2+~cs35.7.26-16build1","11.4.0+dfsg2+~cs35.7.26-18"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"heroic-games-launcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.4.git185.a5708584-2.1"}]}],"bundled":49}],"products":[{"vendor":"naturalintelligence","product":"fast-xml-parser"},{"vendor":"red hat","product":"migration toolkit for applications 8"},{"vendor":"red hat","product":"red hat advanced cluster security 4.8"},{"vendor":"red hat","product":"red hat advanced cluster security 4.9"},{"vendor":"red hat","product":"red hat developer hub 1.8"},{"vendor":"red hat","product":"red hat developer hub 1.9"},{"vendor":"red hat","product":"red hat openshift data foundation 4.18"},{"vendor":"red hat","product":"red hat openshift data foundation 4.19"},{"vendor":"red hat","product":"red hat openshift data foundation 4.20"},{"vendor":"red hat","product":"red hat openshift gitops"},{"vendor":"red hat","product":"red hat openshift virtualization 4"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat satellite 6.18"},{"vendor":"red hat","product":"self-service automation portal 2"}],"references":[{"url":"https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jmr7-xgp7-cmfj","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/NaturalIntelligence/fast-xml-parser/commit/910dae5be2de2955e968558fadf6e8f74f117a77","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.6","tags":["x_refsource_MISC","Product","Release Notes","web","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-26278","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2441120","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26278.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7110","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7128","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6174","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6802","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41941","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41944","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40984","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:51349","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26278","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jmr7-xgp7-cmfj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26278.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-26278","tags":["advisory"]},{"url":"https://github.com/NaturalIntelligence/fast-xml-parser","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-26278","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-26278","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-26278","title":"fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)","description":"fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.","status":"published","published":"2026-02-19T19:40:55.842Z","modified":"2026-09-10T12:05:09.229Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-776","CWE-776"],"updated_at":"2026-11-02T13:38:20.971157Z"}],"euvd":[{"id":"EUVD-2026-7970","description":"fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.","status":"published","published":"2026-02-19T19:40:55Z","modified":"2026-09-10T12:05:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:25.275283Z"}],"ghsa":[{"id":"GHSA-jmr7-xgp7-cmfj","title":"fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)","description":"### Summary\nThe XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application.\n\n### Details\nThere is a check in `DocTypeReader.js` that tries to prevent entity expansion attacks by rejecting entities that reference other entities (it looks for \u0026 inside entity values). This does stop classic “Billion Laughs” payloads.\n\nHowever, it doesn’t stop a much simpler variant.\n\nIf you define one large entity that contains only raw text (no \u0026 characters) and then reference it many times, the parser will happily expand it every time. There is no limit on how large the expanded result can become, or how many replacements are allowed.\n\nThe problem is in `replaceEntitiesValue()` inside `OrderedObjParser.js`. It repeatedly runs `val.replace()` in a loop, without any checks on total output size or execution cost. As the entity grows or the number of references increases, parsing time explodes.\n\nRelevant code:\n\n`DocTypeReader.js` (lines 28–33): entity registration only checks for \u0026\n\n`OrderedObjParser.js` (lines 439–458): entity replacement loop with no limits\n\n### PoC\n\n```js\nconst { XMLParser } = require('fast-xml-parser');\n\nconst entity = 'A'.repeat(1000);\nconst refs = '\u0026big;'.repeat(100);\nconst xml = `\u003c!DOCTYPE foo [\u003c!ENTITY big \"${entity}\"\u003e]\u003e\u003croot\u003e${refs}\u003c/root\u003e`;\n\nconsole.time('parse');\nnew XMLParser().parse(xml); // ~4–8 seconds for ~1.3 KB of XML\nconsole.timeEnd('parse');\n\n// 5,000 chars × 100 refs takes 200+ seconds\n// 50,000 chars × 1,000 refs will hang indefinitely\n```\n\n### Impact\nThis is a straightforward denial-of-service issue.\n\nAny service that parses user-supplied XML using the default configuration is vulnerable. Since Node.js runs on a single thread, the moment the parser starts expanding entities, the event loop is blocked. While this is happening, the server can’t handle any other requests.\n\nIn testing, a payload of only a few kilobytes was enough to make a simple HTTP server completely unresponsive for several minutes, with all other requests timing out.\n\n### Workaround\n\nAvoid using DOCTYPE parsing by `processEntities: false` option.","status":"published","published":"2026-02-17T21:30:10Z","modified":"2026-02-27T16:50:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-776"],"updated_at":"2026-11-02T14:39:27.949248Z"}],"nvd":[{"id":"CVE-2026-26278","description":"fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.","status":"published","published":"2026-02-19T20:25:43.717Z","modified":"2026-09-10T13:17:56.203Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-776"],"updated_at":"2026-11-02T14:12:06.274729Z"}],"osv":[{"id":"CVE-2026-26278","title":"fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)","description":"fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.","status":"published","published":"2026-02-19T19:40:55.842Z","modified":"2026-10-28T02:31:09.480621876Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-776"],"updated_at":"2026-11-02T15:44:59.80315Z"},{"id":"DEBIAN-CVE-2026-26278","description":"fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.","status":"published","published":"2026-02-19T20:25:43.717Z","modified":"2026-10-01T03:03:00.986902003Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"GHSA-jmr7-xgp7-cmfj","title":"fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)","description":"### Summary\nThe XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application.\n\n### Details\nThere is a check in `DocTypeReader.js` that tries to prevent entity expansion attacks by rejecting entities that reference other entities (it looks for \u0026 inside entity values). This does stop classic “Billion Laughs” payloads.\n\nHowever, it doesn’t stop a much simpler variant.\n\nIf you define one large entity that contains only raw text (no \u0026 characters) and then reference it many times, the parser will happily expand it every time. There is no limit on how large the expanded result can become, or how many replacements are allowed.\n\nThe problem is in `replaceEntitiesValue()` inside `OrderedObjParser.js`. It repeatedly runs `val.replace()` in a loop, without any checks on total output size or execution cost. As the entity grows or the number of references increases, parsing time explodes.\n\nRelevant code:\n\n`DocTypeReader.js` (lines 28–33): entity registration only checks for \u0026\n\n`OrderedObjParser.js` (lines 439–458): entity replacement loop with no limits\n\n### PoC\n\n```js\nconst { XMLParser } = require('fast-xml-parser');\n\nconst entity = 'A'.repeat(1000);\nconst refs = '\u0026big;'.repeat(100);\nconst xml = `\u003c!DOCTYPE foo [\u003c!ENTITY big \"${entity}\"\u003e]\u003e\u003croot\u003e${refs}\u003c/root\u003e`;\n\nconsole.time('parse');\nnew XMLParser().parse(xml); // ~4–8 seconds for ~1.3 KB of XML\nconsole.timeEnd('parse');\n\n// 5,000 chars × 100 refs takes 200+ seconds\n// 50,000 chars × 1,000 refs will hang indefinitely\n```\n\n### Impact\nThis is a straightforward denial-of-service issue.\n\nAny service that parses user-supplied XML using the default configuration is vulnerable. Since Node.js runs on a single thread, the moment the parser starts expanding entities, the event loop is blocked. While this is happening, the server can’t handle any other requests.\n\nIn testing, a payload of only a few kilobytes was enough to make a simple HTTP server completely unresponsive for several minutes, with all other requests timing out.\n\n### Workaround\n\nAvoid using DOCTYPE parsing by `processEntities: false` option.","status":"published","published":"2026-02-17T21:30:10Z","modified":"2026-09-10T03:50:35.274601096Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-776"],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"ROOT-APP-NPM-CVE-2026-26278","title":"CVE-2026-26278 in fast-xml-parser - Patched by Root","description":"Root has patched CVE-2026-26278 in the fast-xml-parser package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-02T16:57:32Z","modified":"2026-11-02T17:15:03.182287646Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:00:32.560004Z"},{"id":"UBUNTU-CVE-2026-26278","description":"fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.","status":"published","published":"2026-02-19T20:25:00Z","modified":"2026-10-17T12:56:12.578793112Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"CLSA-2026-1776818199","title":"TuxCare security update for fast-xml-parser (2 CVEs)","description":"TuxCare rebuilt fast-xml-parser to address 2 CVEs. Fixed in 4.5.3-tuxcare.2.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-23T13:58:15.220404137Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1781744119","title":"TuxCare security update for fast-xml-parser (6 CVEs)","description":"TuxCare rebuilt fast-xml-parser to address 6 CVEs. Fixed in 4.2.7-tuxcare.1.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:45:51.439601431Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1781744139","title":"TuxCare security update for fast-xml-parser (6 CVEs)","description":"TuxCare rebuilt fast-xml-parser to address 6 CVEs. Fixed in 4.4.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:38Z","modified":"2026-11-05T13:28:24.682022025Z","updated_at":"2026-11-05T16:37:45.64821Z"},{"id":"CLSA-2026-1790597933","title":"TuxCare security update for fast-xml-parser (2 CVEs)","description":"TuxCare rebuilt fast-xml-parser to address 2 CVEs. Fixed in 4.5.1-tuxcare.4.","status":"published","published":"2026-09-28T12:18:53Z","modified":"2026-10-15T09:48:03.094699469Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792454133","title":"TuxCare security update for fast-xml-parser (7 CVEs)","description":"TuxCare rebuilt fast-xml-parser to address 7 CVEs. Fixed in 5.2.5-tuxcare.1.","status":"published","published":"2026-10-19T23:55:33Z","modified":"2026-10-20T01:45:13.504283365Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792698537","title":"TuxCare security update for fast-xml-parser (3 CVEs)","description":"TuxCare rebuilt fast-xml-parser to address 3 CVEs. Fixed in 4.4.1-tuxcare.2.","status":"published","published":"2026-10-22T19:48:57Z","modified":"2026-10-23T02:00:22.688376856Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"openSUSE-SU-2026:10236-1","title":"heroic-games-launcher-2.20.0-1.1 on GA media","description":"These are all security issues fixed in the heroic-games-launcher-2.20.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-23T00:00:00Z","modified":"2026-03-23T04:54:36.41574Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:11126-1","title":"velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media","description":"These are all security issues fixed in the velociraptor-0.7.0.4.git185.a5708584-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-25T00:00:00Z","modified":"2026-06-26T08:15:07.590096547Z","updated_at":"2026-11-02T16:58:38.95195Z"}]}}