CVE-2026-26278

EUVD-2026-7970

19.02.2026, 20:25

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.

XML Entity Expansion

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 55.14%

Affected Products (NVD)

Vendor	Product	Version
naturalintelligence	fast-xml-parser	4.1.3 ≤ 𝑥 < 5.3.6

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Red Hat	Red Hat Advanced Cluster Security 4.8	1775594119 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Advanced Cluster Security 4.9	1775594284 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Developer Hub 1.8	1774545605 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Developer Hub 1.9	1775140647 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783676191 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783929816 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1784094353 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1784093953 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1784094943 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783676585 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783676649 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783676675 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1784094299 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1784094725 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783676820 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783676883 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783676894 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1784095175 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783676977 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1784093503 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783677297 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783677345 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783677533 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783684360 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783684068 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1784054582 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1784054606 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1784055295 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783684603 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783684668 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783684667 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1784054873 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783684707 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1784055589 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783684779 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783684831 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783684839 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1784055533 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1784055558 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1784056134 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783685128 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783685129 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783685375 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1783667125 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1783666755 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1784054598 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1784055387 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1784055726 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1783667517 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1783667577 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1783667611 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1784055020 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1783667641 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1784055586 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1783667790 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1783667859 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1783667875 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1783667869 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1783667877 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1784055576 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1784055244 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1784055382 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1783668266 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1783668288 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.2	1783669219 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Satellite 6.18	1785922764 ≤ 𝑥 < *	ADP