fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
Summary
| CVE | CVE-2026-26278 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-02-19 20:25:43 UTC |
| Updated | 2026-07-21 12:17:48 UTC |
| Description | fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.008110000 probability, percentile 0.529570000 (date 2026-07-21)
Problem Types: CWE-776 | CWE-776 CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') | CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | [email protected] | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | DECLARED | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Naturalintelligence | Fast-xml-parser | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | NaturalIntelligence | Fast-xml-parser | affected >= 5.0.0, < 5.3.6 | Not specified |
| CNA | NaturalIntelligence | Fast-xml-parser | affected >= 4.1.3, < 4.5.4 | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4.8 | unaffected 1775594119 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4.9 | unaffected 1775594284 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.8 | unaffected 1774545605 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.9 | unaffected 1775140647 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783676191 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783929816 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1784094353 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1784093953 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1784094943 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783676585 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783676649 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783676675 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1784094299 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1784094725 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783676820 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783676883 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783676894 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1784095175 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783676977 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1784093503 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783677297 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783677345 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783677533 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783684360 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783684068 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1784054582 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1784054606 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1784055295 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783684603 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783684668 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783684667 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1784054873 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783684707 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1784055589 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783684779 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783684831 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783684839 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1784055533 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1784055558 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1784056134 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783685128 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783685129 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783685375 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667125 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783666755 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784054598 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055387 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055726 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667517 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667577 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667611 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055020 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667641 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055586 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667790 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667859 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667875 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667869 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667877 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055576 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055244 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055382 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783668266 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783668288 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783669219 * rpm | Not specified |
| ADP | Red Hat | Migration Toolkit For Applications 8 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift GitOps | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift GitOps | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Virtualization 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Virtualization 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Satellite 6 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Satellite 6 | Not specified | Not specified |
| ADP | Red Hat | Self-service Automation Portal 2 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:6802 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:6174 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:40984 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.6 | [email protected] | github.com | Product, Release Notes |
| access.redhat.com/errata/RHSA-2026:7110 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:7128 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-26278 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:41944 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-... | [email protected] | github.com | Exploit, Vendor Advisory |
| access.redhat.com/errata/RHSA-2026:41941 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26278.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| github.com/NaturalIntelligence/fast-xml-parser/commit/910dae5be2de2955e9... | [email protected] | github.com | Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2026-02-19T21:03:33.363Z | Reported to Red Hat. |
| ADP | 2026-02-19T19:40:55.842Z | Made public. |
Solutions
ADP: RHSA-2026:7110: Red Hat Advanced Cluster Security 4.8
ADP: RHSA-2026:7128: Red Hat Advanced Cluster Security 4.9
ADP: RHSA-2026:6174: Red Hat Developer Hub 1.8
ADP: RHSA-2026:6802: Red Hat Developer Hub 1.9
ADP: RHSA-2026:41941: Red Hat Openshift Data Foundation 4.18
ADP: RHSA-2026:41944: Red Hat Openshift Data Foundation 4.19
ADP: RHSA-2026:40984: Red Hat Openshift Data Foundation 4.2
Workarounds
ADP: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
There are currently no legacy QID mappings associated with this CVE.