CVE-2026-27942
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback.
Published Feb 26, 2026 · updated Jun 17, 2026 · naturalintelligence fast-xml-parser
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with . Version 5.3.8 fixes the issue. As a workaround, use XML builder with or check the input data before passing to builder.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Feb 26, 2026 · NIST NVD
Detected
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with . Version 5.3.8 fixes the issue. As a workaround, use XML builder with or check the input data before passing to builder.
Jun 17, 2026 · NIST NVD
Updated
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with . Version 5.3.8 fixes the issue. As a workaround, use XML builder with or check the input data before passing to builder.
Affected
- cpe naturalintelligence/fast-xml-parserversion unspecified
Sources
- NIST NVDVulnerability recordCVE-2026-27942
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with . Version 5.3.8
nvd.nist.gov