5-ifc-check-cli (1.0.0), 7ghost (>=4.11.2, <=4.11.46) +4234 more potentially affected by CVE-2026-33036 via fast-xml-parser (>=4.0.0, <=4.5.4)

fast-xml-parser NPM version =4.0.0, =4.11.2, =0.1.1, =0.0.2, =1.0.1, =1.0.0, =0.0.1, =1.0.0, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2026-33036 Source advisory: OSV:GHSA-8GC5-J5RX-235R...

@activepieces/piece-amazon-s3 (>=0.5.8, <=0.6.4), @activepieces/piece-amazon-ses (>=0.0.1, <=0.1.4) +1278 more potentially affected by CVE-2026-33036 via fast-xml-parser (>=5.0.1, <=5.5.5)

fast-xml-parser NPM version =5.0.1, =0.5.8, =0.0.1, =13.1.4, =1.0.0, =1.9.12, =1.0.3, =1.1.31, =1.0.0, =1.0.0, =1.7.16, =2.33.6, =1.4.37, =1.6.3 and more Source cves: CVE-2026-33036 Source advisory: OSV:GHSA-8GC5-J5RX-235R...

GHSA-8GC5-J5RX-235R fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

Summary The fix for CVE-2026-26278 added entity expansion limits maxTotalExpansions, maxExpandedLength, maxEntityCount, maxEntitySize to prevent XML entity expansion Denial of Service. However, these limits are only enforced for DOCTYPE-defined entities. Numeric character references &NNN; and &xH...

fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

Summary The fix for CVE-2026-26278 added entity expansion limits maxTotalExpansions, maxExpandedLength, maxEntityCount, maxEntitySize to prevent XML entity expansion Denial of Service. However, these limits are only enforced for DOCTYPE-defined entities. Numeric character references &NNN; and &xH...

0xuath-sdk-react (>=0.0.2, <=0.0.23), 1-test-gulp-1 (>=0.0.1, <=0.0.4) +15506 more potentially affected by CVE-2026-26278 +1 more via fast-xml-parser (>=4.0.0, <=5.5.5)

fast-xml-parser NPM version =4.0.0, =0.0.2, =0.0.1, =0.0.1, =1.0.0, =3.1.4, =0.1.0, =3.1.6, =0.1.0, =0.0.2, =4.11.2, =4.11.46 - @0610studio/rn-layout 0.0.1 - @0xflick/jest-dynamodb 4.0.1-pre.2 and more Source cves: CVE-2026-26278, CVE-2026-33036 Source advisory: SNYK:JS-FASTXMLPARSER-15677840...

PT-2026-25995

Name of the Vulnerable Software and Affected Versions fast-xml-parser versions 4.0.0-beta.3 through 5.5.5 Description fast-xml-parser allows users to process XML from JavaScript objects without relying on C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass tha...

Stack Overflow

fast-xml-parser is vulnerable to stack overflow vulnerability. The vulnerability is due to improper handling in the XML builder when preserveOrder:true is enabled, which allows an attacker to trigger a stack overflow and crash the application by providing crafted input data...

Linux Distros Unpatched Vulnerability : CVE-2026-27942

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to versio...

📄 fast-xml-parser 5.3.5 Denial of Service

A denial of service vulnerability was identified in fast-xml-parser affecting versions 4.1.3 through 5.3.5. The issue arises from improper handling of XML Document Type Definitions DTD, specifically when processing internal entity expansion. An attacker can supply a crafted XML payload containing...

@activepieces/piece-amazon-s3 (>=0.5.8, <=0.6.4), @activepieces/piece-amazon-ses (>=0.0.1, <=0.1.4) +1248 more potentially affected by CVE-2026-27942 via fast-xml-parser (>=5.0.1, <=5.3.7)

fast-xml-parser NPM version =5.0.1, =0.5.8, =0.0.1, =13.1.4, =1.0.0, =1.9.12, =1.0.3, =1.1.31, =1.0.0, =1.0.0, =1.7.16, =2.33.6, =1.4.37, =1.6.3 and more Source cves: CVE-2026-27942 Source advisory: OSV:GHSA-FJ3W-JWP8-X2G3...

GHSA-FJ3W-JWP8-X2G3 fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

Impact Application crashes with stack overflow when user use XML builder with prserveOrder:true for following or similar input 'foo': 'bar': '@V': 'baz' Cause: arrToStr was not validating if the input is an array or a string and treating all non-array values as text content. What kind of...

fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

Impact Application crashes with stack overflow when user use XML builder with prserveOrder:true for following or similar input 'foo': 'bar': '@V': 'baz' Cause: arrToStr was not validating if the input is an array or a string and treating all non-array values as text content. What kind of...

5-ifc-check-cli (1.0.0), 7ghost (>=4.11.2, <=4.11.46) +4233 more potentially affected by CVE-2026-27942 via fast-xml-parser (>=4.0.0, <=4.5.3)

fast-xml-parser NPM version =4.0.0, =4.11.2, =0.1.1, =0.0.2, =1.0.1, =1.0.0, =0.0.1, =1.0.0, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2026-27942 Source advisory: OSV:GHSA-FJ3W-JWP8-X2G3...

CVE-2026-27942

A flaw was found in fast-xml-parser. A user can exploit this flaw by processing specially crafted XML data with the XML builder when the preserveOrder option is enabled. This can lead to a stack overflow, causing the application to crash and resulting in a Denial of Service DoS. Mitigation To...

5-ifc-check-cli (1.0.0), 7ghost (>=4.11.2, <=4.11.46) +4233 more potentially affected by CVE-2026-27942 via fast-xml-parser (>=4.0.0, <=4.5.3)

fast-xml-parser NPM version =4.0.0, =4.11.2, =0.1.1, =0.0.2, =1.0.1, =1.0.0, =0.0.1, =1.0.0, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2026-27942 Source advisory: SNYK:JS-FASTXMLPARSER-15353391...

@activepieces/piece-amazon-s3 (>=0.5.8, <=0.6.4), @activepieces/piece-amazon-ses (>=0.0.1, <=0.1.4) +1248 more potentially affected by CVE-2026-27942 via fast-xml-parser (>=5.0.1, <=5.3.7)

fast-xml-parser NPM version =5.0.1, =0.5.8, =0.0.1, =13.1.4, =1.0.0, =1.9.12, =1.0.3, =1.1.31, =1.0.0, =1.0.0, =1.7.16, =2.33.6, =1.4.37, =1.6.3 and more Source cves: CVE-2026-27942 Source advisory: SNYK:JS-FASTXMLPARSER-15353391...

Buffer Overflow

Overview org.webjars.npm:fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to Buffer Overflow via the XMLBuilder when preserveOrder:true is set. An attacker can cause the application to crash by providing special...

Buffer Overflow

Overview fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to Buffer Overflow via the XMLBuilder when preserveOrder:true is set. An attacker can cause the application to crash by providing specially crafted input...

DEBIAN-CVE-2026-27942

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with preserveOrder:true. Version 5.3.8 fixes the issue. As...

CVE-2026-27942

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with preserveOrder:true. Version 5.3.8 fixes the issue. As...