Skip to content
Fencer Vulns
high 7.5

CVE-2026-27942 json

fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

published 2026-02-26 8 mo ago modified 2026-09-10 1 mo ago also GHSA-fj3w-jwp8-x2g3 , EUVD-2026-8811

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder.

Patch / fix

  • npm fast-xml-parser 4.5.4, 5.3.8
  • naturalintelligence fast-xml-parser 4.5.4, 5.3.8

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-27942 updated cvss 7.5

fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service

  • Red Hat Migration Toolkit for Applications 8 mta/mta-ui-rhel9 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal
    affected: workaround, no fix available
  • Red Hat Advanced Cluster Security 4.8 advanced-cluster-security 1775594119
    fixed: vendor fix RHSA-2026:7110
  • Red Hat Advanced Cluster Security 4.9 advanced-cluster-security 1775594284
    fixed: vendor fix RHSA-2026:7128
  • Red Hat Developer Hub 1.8 rhdh 1774545605
    fixed: vendor fix RHSA-2026:6174
  • Red Hat Developer Hub 1.9 rhdh 1775140647
    fixed: vendor fix RHSA-2026:6802
  • Red Hat Openshift Data Foundation 4.18 odf4/cephcsi-rhel9 1783676191, odf4/odf-cli-rhel9 1784094299, odf4/mcg-core-rhel9 1784094353, odf4/odf-console-rhel9 1784094725, odf4/mcg-rhel9-operator 1784093953, odf4/ocs-rhel9-operator 1783676675, +13 more
    fixed: vendor fix RHSA-2026:41941
  • Red Hat Openshift Data Foundation 4.19 odf4/cephcsi-rhel9 1783684360, odf4/odf-cli-rhel9 1784054873, odf4/mcg-core-rhel9 1784054582, odf4/odf-console-rhel9 1784055589, odf4/mcg-rhel9-operator 1784054606, odf4/ocs-rhel9-operator 1783684667, +14 more
    fixed: vendor fix RHSA-2026:41944
  • Red Hat Openshift Data Foundation 4.20 odf4 1775822432, odf4 1775822689, odf4 1775823207, odf4 1776403457, odf4 1776403991, odf4 1776404009, +37 more
    fixed: vendor fix RHSA-2026:12277
show 4 more
  • Red Hat Satellite 6.18 satellite/iop-host-inventory-frontend-rhel9 1785922764
    fixed: vendor fix RHSA-2026:51349
  • Red Hat Advanced Cluster Security 4.8 advanced-cluster-security 1774163438, advanced-cluster-security 1774294180, advanced-cluster-security 1775594119 Red Hat Advanced Cluster Security 4.9 advanced-cluster-security 1774260292, advanced-cluster-security 1774294136, advanced-cluster-security 1775594284 Red Hat Developer Hub 1.8 rhdh 1774544220, rhdh 1774549552 Red Hat Developer Hub 1.9 rhdh 1775140369, rhdh 1775155242 Red Hat Openshift Data Foundation 4.18 odf4/mcg-operator-bundle 1784096858, odf4/ocs-operator-bundle 1784097072, odf4/odf-operator-bundle 1784097342, odf4/cephcsi-operator-bundle 1784096750, odf4/odr-hub-operator-bundle 1784097501, odf4/rook-ceph-operator-bundle 1784098364, +7 more Red Hat Openshift Data Foundation 4.19 odf4/mcg-operator-bundle 1784058120, odf4/ocs-operator-bundle 1784058383, odf4/odf-operator-bundle 1784058758, odf4/cephcsi-operator-bundle 1784057956, odf4/odr-hub-operator-bundle 1784058873, odf4/rook-ceph-operator-bundle 1784059042, +7 more
    +1 more products
    Red Hat Openshift Data Foundation 4.20 odf4 1776421513, odf4 1776421515, odf4 1776421520, odf4 1776421524, odf4 1776421528, odf4 1776421532, +21 more
    not affected: vulnerable code not present
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9
    not affected: inline mitigations already exist
  • Red Hat Satellite 6 satellite/iop-vulnerability-frontend-rhel9
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
8 mo ago

Exploit prediction

0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 2.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
CNA 4.0 2.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm fast-xml-parser
>=5.0.0, <5.3.8
>=4.0.0-beta.0, <4.5.4
5.3.8
4.5.4

Affected products

  • NaturalIntelligence fast-xml-parser

Classification

Weakness
  • CWE-120 Buffer Copy without Checking Size of Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.