XML Entity Expansion

Overview fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to XML Entity Expansion in the replaceEntitiesValue function, which doesn't protect unlimited expansion of numeric entities the way it does DOCTYPE data ...

GHSA-8GC5-J5RX-235R fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

Summary The fix for CVE-2026-26278 added entity expansion limits maxTotalExpansions, maxExpandedLength, maxEntityCount, maxEntitySize to prevent XML entity expansion Denial of Service. However, these limits are only enforced for DOCTYPE-defined entities. Numeric character references &NNN; and &xH...

XML Entity Expansion

Overview org.webjars.npm:fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to XML Entity Expansion in the replaceEntitiesValue function, which doesn't protect unlimited expansion of numeric entities the way it do...

fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

Summary The fix for CVE-2026-26278 added entity expansion limits maxTotalExpansions, maxExpandedLength, maxEntityCount, maxEntitySize to prevent XML entity expansion Denial of Service. However, these limits are only enforced for DOCTYPE-defined entities. Numeric character references &NNN; and &xH...

com.codbex.atlas:codbex-atlas-application (>=2.62.0, <=14.47.0), com.codbex.gaia:codbex-gaia-application (>=2.61.0, <=14.47.0) +25 more potentially affected by CVE-2026-26278 +1 more via org.webjars.npm:fast-xml-parser (>=4.5.3, <=5.8.0)

org.webjars.npm:fast-xml-parser MAVEN version =4.5.3, =2.62.0, =2.61.0, =2.52.0, =2.52.0, =2.51.0, =2.51.0, =3.6.0, =2.50.0, =5.0.0, =5.0.0, =11.58.0, =12.2.0, =11.58.0, =11.58.0, =14.19.0, =14.47.0 and more Source cves: CVE-2026-26278, CVE-2026-33036 Source advisory:...

0xuath-sdk-react (>=0.0.2, <=0.0.23), 1-test-gulp-1 (>=0.0.1, <=0.0.4) +15481 more potentially affected by CVE-2026-26278 +1 more via fast-xml-parser (>=4.0.0, <=5.5.5)

fast-xml-parser NPM version =4.0.0, =0.0.2, =0.0.1, =0.0.1, =1.0.0, =3.1.4, =0.1.0, =3.1.6, =0.1.0, =0.0.2, =4.11.2, =4.11.46 - @0610studio/rn-layout 0.0.1 - @0xflick/jest-dynamodb 4.0.1-pre.2 and more Source cves: CVE-2026-26278, CVE-2026-33036 Source advisory: SNYK:JS-FASTXMLPARSER-15677840...

CVE-2026-26278 vulnerabilities

Vulnerabilities for packages: saf, kubeflow-pipelines, prism, tileserver-gl, renovate, jitsucom-jitsu...

CVE-2026-26278 vulnerabilities

Vulnerabilities for packages: dbgate, renovate, jitsucom-jitsu, kubeflow-pipelines, langfuse, tileserver-gl-fips, prism, librechat, langfuse-fips, saf, tileserver-gl, kibana, dbgate-fips...

5-ifc-check-cli (1.0.0), 7ghost (>=4.11.2, <=4.11.46) +3946 more potentially affected by CVE-2026-26278 via fast-xml-parser (>=4.1.3, <=4.5.3)

fast-xml-parser NPM version =4.1.3, =4.11.2, =0.1.1, =0.0.2, =1.0.1, =1.0.0, =0.0.1, =1.0.0, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2026-26278 Source advisory: OSV:GHSA-JMR7-XGP7-CMFJ...

5-ifc-check-cli (1.0.0), 7ghost (>=4.11.2, <=4.11.46) +3946 more potentially affected by CVE-2026-26278 via fast-xml-parser (>=4.1.3, <=4.5.3)

fast-xml-parser NPM version =4.1.3, =4.11.2, =0.1.1, =0.0.2, =1.0.1, =1.0.0, =0.0.1, =1.0.0, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2026-26278 Source advisory: SNYK:JS-FASTXMLPARSER-15307668...

com.codbex.atlas:codbex-atlas-application (>=2.62.0, <=14.47.0), com.codbex.gaia:codbex-gaia-application (>=2.61.0, <=14.47.0) +25 more potentially affected by CVE-2026-26278 via org.webjars.npm:fast-xml-parser (>=4.5.3, <=5.8.0)

org.webjars.npm:fast-xml-parser MAVEN version =4.5.3, =2.62.0, =2.61.0, =2.52.0, =2.52.0, =2.51.0, =2.51.0, =3.6.0, =2.50.0, =5.0.0, =5.0.0, =11.58.0, =12.2.0, =11.58.0, =11.58.0, =14.19.0, =14.47.0 and more Source cves: CVE-2026-26278 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15325721...

@activepieces/piece-amazon-s3 (>=0.5.4, <=0.6.4), @activepieces/piece-amazon-ses (>=0.0.1, <=0.1.4) +1124 more potentially affected by CVE-2026-26278 via fast-xml-parser (>=5.0.1, <=5.3.5)

fast-xml-parser NPM version =5.0.1, =0.5.4, =0.0.1, =0.1.3, =13.1.4, =1.0.0, =1.9.12, =1.0.3, =1.1.31, =1.0.0, =1.0.0, =1.7.16, =2.33.6, =1.4.37, =1.6.3 and more Source cves: CVE-2026-26278 Source advisory: SNYK:JS-FASTXMLPARSER-15307668...

@activepieces/piece-amazon-s3 (>=0.5.4, <=0.6.4), @activepieces/piece-amazon-ses (>=0.0.1, <=0.1.4) +1124 more potentially affected by CVE-2026-26278 via fast-xml-parser (>=5.0.1, <=5.3.5)

fast-xml-parser NPM version =5.0.1, =0.5.4, =0.0.1, =0.1.3, =13.1.4, =1.0.0, =1.9.12, =1.0.3, =1.1.31, =1.0.0, =1.0.0, =1.7.16, =2.33.6, =1.4.37, =1.6.3 and more Source cves: CVE-2026-26278 Source advisory: OSV:GHSA-JMR7-XGP7-CMFJ...

CVE-2026-26278

creationtimestamp| type| source ---|---|--- 2026-02-14 06:07:36+00:00| published-proof-of-concept| https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jmr7-xgp7-cmfj 2026-02-19 21:01:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfaihpafsp2n...