CVE-2026-126066

The fast-xml-parser library is vulnerable to a CPU-exhaustion denial of service prior to version 5.12.0 . When the non-default stopNodes option is enabled, the readStopNodeData() function in OrderedObjParser.js calls readTagExp() for each less-than character in an unterminated stop-node body. Thi...