CVE-2026-126066

Name of the Vulnerable Software and Affected Versions fast-xml-parser versions prior to 5.12.0

Description When the non-default stopNodes option is enabled, the software is susceptible to CPU exhaustion. The readStopNodeData() function in OrderedObjParser.js calls readTagExp() for every less-than character in an unterminated stop-node body. Because the failed lookahead for a closing greater-than character is neither cached nor bounded, the parser repeatedly rescans the remaining input. An attacker providing XML with numerous tag fragments lacking a closing character can trigger quadratic rescanning, which blocks the Node.js event loop and leads to a denial of service.

Recommendations Update to version 5.12.0. As a temporary mitigation, disable the stopNodes option when parsing untrusted XML.