Skip to content
OpenAdvisories
Low · 3.7 CVE-2026-126066 EUVD-2026-122845GHSA-474x-hrwr-fgx4

fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags

Published Nov 10, 2026 · Updated Nov 12, 2026 · Assigned by GitHub_M

Description

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData() in OrderedObjParser.js calls readTagExp() for each less-than character in an unterminated stop-node body and repeatedly rescans the remaining input while looking for a closing greater-than character. An attacker who supplies XML containing many tag fragments without a later closing character can cause quadratic rescanning before parsing fails, blocking a Node.js event loop and causing CPU-exhaustion denial of service. This issue is fixed in version 5.12.0.

Affected products

VendorProductAffectedFixed
NaturalIntelligence fast-xml-parser < 5.12.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling jitsucom-jitsu-console 2.11.0-r43 —
Wolfi rolling langfuse-3 +1 3.227.1-r1 —
Wolfi rolling nextcloud-server-33 33.0.10-r8 —
Wolfi rolling opensearch-dashboards-3 3.9.0-r11 —
Wolfi rolling prism 5.16.0-r25 —
Wolfi rolling saf +1 No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
npm fast-xml-parser < 5.12.0 5.12.0 GHSA-474x-hrwr-fgx4

References