fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

Impact Application crashes with stack overflow when user use XML builder with prserveOrder:true for following or similar input 'foo': 'bar': '@V': 'baz' Cause: arrToStr was not validating if the input is an array or a string and treating all non-array values as text content. What kind of...

5-ifc-check-cli (1.0.0), 7ghost (>=4.11.2, <=4.11.46) +4218 more potentially affected by CVE-2026-27942 via fast-xml-parser (>=4.0.0, <=4.5.3)

fast-xml-parser NPM version =4.0.0, =4.11.2, =0.1.1, =0.0.2, =1.0.1, =1.0.0, =1.52.0, =0.0.1, =1.0.0, =0.0.1, =1.1.2 and more Source cves: CVE-2026-27942 Source advisory: OSV:GHSA-FJ3W-JWP8-X2G3...

@lapidist/design-lint (>=6.1.0, <=7.0.1), @markuplint/svelte-parser (>=5.0.0-alpha.0, <=5.0.0-alpha.2) +2 more potentially affected by CVE-2026-27902 via svelte (>=5.53.0, <=5.53.3)

svelte NPM version =5.53.0, =6.1.0, =5.0.0-alpha.0, =5.0.0-alpha.2 - @networkpro/web 1.26.10 - dumbo-svelte 0.3.1 Source cves: CVE-2026-27902 Source advisory: OSV:GHSA-QGVG-PR8V-6RR3...

RLSA-2026:3338 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: libvpx: Heap buffer overflow in libvpx CVE-2026-2447 firefox: Invalid pointer in the JavaScript Engine component CVE-2026-2785 firefox: Memory safety bugs fixed in Firef...

CVE-2026-26932

Improper Validation of Array Index CWE-129 in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation CAPEC-153. An attacker can send a specially crafted packet causing a Go runtime panic that terminates the Packetbeat process. This vulnerability requir...

CVE-2026-23747 Golioth Firmware SDK < 0.22.0 Payload Utils Stack-based Buffer Overflow

Golioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit 48f521b, contain a stack-based buffer overflow in Payload Utils. The goliothpayloadasint and goliothpayloadasfloat helpers copy network-supplied payload data into fixed-size stack buffers using memcpy with a length derived from...

CVE-2026-26932

CVE-2026-26932 affects Elastic Packetbeat (PostgreSQL protocol parser) and can cause a Denial of Service via a Go runtime panic when the pgsql protocol is enabled and monitoring traffic on the targeted port. Affected versions include Packetbeat 8.x (up to 8.19.10) and 9.x (up to 9.2.4). The under...

CVE-2026-27942

A flaw was found in fast-xml-parser. A user can exploit this flaw by processing specially crafted XML data with the XML builder when the preserveOrder option is enabled. This can lead to a stack overflow, causing the application to crash and resulting in a Denial of Service DoS. Mitigation To...

CLSA-2026-1772110471 glib2: Fix of CVE-2025-14087

CVE-2025-14087: Fix integer overflows in GVariant text format parser and escapebytestring...

curl: RTSP RTP Interleaved Parser Assertion Failure (Zero-Length RTP Payload)

Summary: I am submitting this as a security issue primarily due to how it was discovered and that it's my first Curl submission, but I suspect I might be overly cautious here. This issue was discovered as part of the AIXCC competition, and I am assisting on reporting true positive findings to...

5-ifc-check-cli (1.0.0), 7ghost (>=4.11.2, <=4.11.46) +4218 more potentially affected by CVE-2026-27942 via fast-xml-parser (>=4.0.0, <=4.5.3)

fast-xml-parser NPM version =4.0.0, =4.11.2, =0.1.1, =0.0.2, =1.0.1, =1.0.0, =1.52.0, =0.0.1, =1.0.0, =0.0.1, =1.1.2 and more Source cves: CVE-2026-27942 Source advisory: SNYK:JS-FASTXMLPARSER-15353391...

@activepieces/piece-amazon-s3 (>=0.5.4, <=0.6.4), @activepieces/piece-amazon-ses (>=0.0.1, <=0.1.4) +1129 more potentially affected by CVE-2026-27942 via fast-xml-parser (>=5.0.1, <=5.3.7)

fast-xml-parser NPM version =5.0.1, =0.5.4, =0.0.1, =0.1.3, =0.5.3, =0.2.1, =13.1.4, =1.0.0, =1.9.12, =1.0.3, =1.1.31, =1.0.0, =1.0.0, =1.7.16, =1.10.0 and more Source cves: CVE-2026-27942 Source advisory: SNYK:JS-FASTXMLPARSER-15353391...

Buffer Overflow

Overview org.webjars.npm:fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to Buffer Overflow via the XMLBuilder when preserveOrder:true is set. An attacker can cause the application to crash by providing special...

com.codbex.atlas:codbex-atlas-application (>=2.62.0, <=2.120.0), com.codbex.gaia:codbex-gaia-application (>=2.61.0, <=2.104.0) +25 more potentially affected by CVE-2026-27942 via org.webjars.npm:fast-xml-parser (>=4.5.3, <=5.8.0)

org.webjars.npm:fast-xml-parser MAVEN version =4.5.3, =2.62.0, =2.61.0, =2.52.0, =2.52.0, =2.51.0, =2.51.0, =3.6.0, =2.50.0, =5.0.0, =5.0.0, =11.58.0, =12.2.0, =11.58.0, =11.58.0, =14.19.0, =14.28.0 and more Source cves: CVE-2026-27942 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15353392...

Buffer Overflow

Overview fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to Buffer Overflow via the XMLBuilder when preserveOrder:true is set. An attacker can cause the application to crash by providing specially crafted input...

Denial Of Service (DoS)

Nodemailer is vulnerable to a denial of service DoS. The vulnerability is due to improper handling of a crafted email address header that triggers infinite recursion in the address parser, which allows an attacker to exhaust resources and disrupt service availability...

DEBIAN-CVE-2026-27942

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with preserveOrder:true. Version 5.3.8 fixes the issue. As...

CVE-2026-27942

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with preserveOrder:true. Version 5.3.8 fixes the issue. As...

CVE-2026-27942

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with preserveOrder:true. Version 5.3.8 fixes the issue. As...

UBUNTU-CVE-2026-27942

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with preserveOrder:true. Version 5.3.8 fixes the issue. As...