CVE-2026-27942

Name of the Vulnerable Software and Affected Versions fast-xml-parser versions prior to 5.3.8

Description fast-xml-parser is a tool for XML validation, parsing XML to JavaScript objects, and building XML from JavaScript objects without relying on C/C++ libraries or callbacks. Prior to version 5.3.8, the application is susceptible to a stack overflow when utilizing the XML builder with the preserveOrder option set to true. This can lead to application crashes. As a temporary measure, using the XML builder with preserveOrder set to false or validating input data before passing it to the builder can mitigate the issue.

Recommendations Update to version 5.3.8 or later. As a temporary workaround, use the XML builder with preserveOrder:false. Validate input data before passing it to the builder.