CVE-2026-126066

The fast-xml-parser library is vulnerable to a CPU-exhaustion denial of service prior to version 5.12.0 . When the non-default stopNodes option is enabled, the readStopNodeData() function in OrderedObjParser.js calls readTagExp() for each less-than character in an unterminated stop-node body. Thi...

EUVD-2026-122845

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData in OrderedObjParser.js calls readTagExp for each less-than character in an unterminated stop-node body and...