Log in Start free

Vulnerability · Published Feb 19, 2026 · Assigned by GitHub_M

CVE-2026-26278fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

High 7.5

In plain English

A high-severity security flaw in fast-xml-parser from NaturalIntelligence. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.9%top 39.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-webfontno fix listedDEBIAN-CVE-2026-26278
Debian:13node-webfontno fix listedDEBIAN-CVE-2026-26278
Debian:14node-webfontno fix listedDEBIAN-CVE-2026-26278
Ubuntu:24.04:LTSnode-webfontno fix listedUBUNTU-CVE-2026-26278
Ubuntu:25.10node-webfontno fix listedUBUNTU-CVE-2026-26278
Ubuntu:26.04:LTSnode-webfontno fix listedUBUNTU-CVE-2026-26278
Ubuntu:26.10node-webfontno fix listedUBUNTU-CVE-2026-26278
npmfast-xml-parser5.3.6GHSA-jmr7-xgp7-cmfj
npmfast-xml-parser4.5.4GHSA-jmr7-xgp7-cmfj

Affected products (as reported)

VendorProductVersions
NaturalIntelligence fast-xml-parser >= 5.0.0, < 5.3.6>= 4.1.3, < 4.5.4

Weakness: CWE-776 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References