CVE-2026-26278
published 2026-02-19CVE-2026-26278: fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.84%
54.1th percentile
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-webfont | — | — |
| naturalintelligence | fast-xml-parser | — | — |
| naturalintelligence | fast-xml-parser | — | — |
| naturalintelligence | fast-xml-parser | >= 4.0.0-beta.3 < 4.5.5 | 4.5.5 |
| naturalintelligence | fast-xml-parser | >= 4.0.1 < 5.5.6 | 5.5.6 |
| naturalintelligence | fast-xml-parser | >= 4.1.3 < 5.3.6 | 5.3.6 |
| naturalintelligence | fast-xml-parser | >= 4.1.3 < 4.5.4 | 4.5.4 |
| naturalintelligence | fast-xml-parser | >= 5.0.0 < 5.5.6 | 5.5.6 |
| naturalintelligence | fast-xml-parser | >= 5.0.0 < 5.3.6 | 5.3.6 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ghsa7.5HIGH
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass
vendor_redhat·2026-03-20·CVSS 7.5
CVE-2026-33036 [HIGH] CWE-776 fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass
fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, &#xHH;) and standard XML entities completely evade the entity expansion limits (e.g., maxTotalExpansions, maxExpandedLength) added to fix CVE-2026-26278, enabling XML entity expansion Denial of Service. The root cause is that replaceEntitiesValue() in OrderedObjParser.js only enforces expansion counting on DOCTYPE-defined entities while the lastEntities loop handling numeric/standard entities performs no counting at all. An attacker supplying 1M numeric entity references like A can force ~147MB o
Red Hat
fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion
vendor_redhat·2026-02-19·CVSS 7.5
CVE-2026-26278 [HIGH] CWE-776 fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion
fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.
A denial of service flaw was found in fast-xml-parser. A remote attacker can exploit this vulnerability by providing a specially crafted, small XML input. This input can force the XML pa
Debian
CVE-2026-26278: node-webfont - fast-xml-parser allows users to validate XML, parse XML to JS object, or build X...
vendor_debian·2026·CVSS 7.5
CVE-2026-26278 [HIGH] CVE-2026-26278: node-webfont - fast-xml-parser allows users to validate XML, parse XML to JS object, or build X...
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.
Scope: local
bookworm: undetermined
forky: undetermined
sid: undetermined
trixie: undetermined
Debian
CVE-2026-33036: node-webfont - fast-xml-parser allows users to process XML from JS object without C/C++ based l...
vendor_debian·2026·CVSS 7.5
CVE-2026-33036 [HIGH] CVE-2026-33036: node-webfont - fast-xml-parser allows users to process XML from JS object without C/C++ based l...
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, &#xHH;) and standard XML entities completely evade the entity expansion limits (e.g., maxTotalExpansions, maxExpandedLength) added to fix CVE-2026-26278, enabling XML entity expansion Denial of Service. The root cause is that replaceEntitiesValue() in OrderedObjParser.js only enforces expansion counting on DOCTYPE-defined entities while the lastEntities loop handling numeric/standard entities performs no counting at all. An attacker supplying 1M numeric entity references like A can force ~147MB of memory allocation and heavy CPU usage, potentially crashing the process—even when d
VulDB
NaturalIntelligence fast-xml-parser up to 5.3.5 XML Parser xml entity expansion (GHSA-jmr7-xgp7-cmfj / Nessus ID 299641)
vuldb·2026-07-01·CVSS 7.5
CVE-2026-26278 [HIGH] NaturalIntelligence fast-xml-parser up to 5.3.5 XML Parser xml entity expansion (GHSA-jmr7-xgp7-cmfj / Nessus ID 299641)
A vulnerability labeled as problematic has been found in NaturalIntelligence fast-xml-parser up to 5.3.5. The impacted element is an unknown function of the component XML Parser. Such manipulation leads to xml entity expansion.
This vulnerability is listed as CVE-2026-26278. The attack may be performed from remote. There is no available exploit.
The affected component should be upgraded.
OSV
CVE-2026-33036: fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks
osv·2026-03-20·CVSS 7.5
CVE-2026-33036 [HIGH] CVE-2026-33036: fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, &#xHH;) and standard XML entities completely evade the entity expansion limits (e.g., maxTotalExpansions, maxExpandedLength) added to fix CVE-2026-26278, enabling XML entity expansion Denial of Service. The root cause is that replaceEntitiesValue() in OrderedObjParser.js only enforces expansion counting on DOCTYPE-defined entities while the lastEntities loop handling numeric/standard entities performs no counting at all. An attacker supplying 1M numeric entity references like A can force ~147MB of memory allocation and heavy CPU usage, potentially crashing the process—even when d
GHSA
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
ghsa·2026-03-17·CVSS 7.5
CVE-2026-33036 [HIGH] CWE-776 fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
## Summary
The fix for CVE-2026-26278 added entity expansion limits (`maxTotalExpansions`, `maxExpandedLength`, `maxEntityCount`, `maxEntitySize`) to prevent XML entity expansion Denial of Service. However, these limits are only enforced for DOCTYPE-defined entities. **Numeric character references** (`&#NNN;` and `&#xHH;`) and standard XML entities (` `, etc.) are processed through a separate code path that does NOT enforce any expansion limits.
An attacker can use massive numbers of numeric entity references to completely bypass all configured limits, causing excessive memory allocation and CPU consumption.
## Affected Versions
fast-xml-parser v5.x through v5
OSV
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
osv·2026-03-17·CVSS 7.5
CVE-2026-33036 [HIGH] fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
## Summary
The fix for CVE-2026-26278 added entity expansion limits (`maxTotalExpansions`, `maxExpandedLength`, `maxEntityCount`, `maxEntitySize`) to prevent XML entity expansion Denial of Service. However, these limits are only enforced for DOCTYPE-defined entities. **Numeric character references** (`&#NNN;` and `&#xHH;`) and standard XML entities (` `, etc.) are processed through a separate code path that does NOT enforce any expansion limits.
An attacker can use massive numbers of numeric entity references to completely bypass all configured limits, causing excessive memory allocation and CPU consumption.
## Affected Versions
fast-xml-parser v5.x through v5
OSV
CVE-2026-26278: fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback
osv·2026-02-19·CVSS 7.5
CVE-2026-26278 [HIGH] CVE-2026-26278: fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.
GHSA
fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
ghsa·2026-02-17
CVE-2026-26278 [HIGH] CWE-776 fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
### Summary
The XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application.
### Details
There is a check in `DocTypeReader.js` that tries to prevent entity expansion attacks by rejecting entities that reference other entities (it looks for & inside entity values). This does stop classic “Billion Laughs” payloads.
However, it doesn’t stop a much simpler variant.
If you define one large entity that contains only raw text (no & characters) and then reference it many times, the parser will happily expand it every time. There is no lim
OSV
fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
osv·2026-02-17
CVE-2026-26278 [HIGH] fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
### Summary
The XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application.
### Details
There is a check in `DocTypeReader.js` that tries to prevent entity expansion attacks by rejecting entities that reference other entities (it looks for & inside entity values). This does stop classic “Billion Laughs” payloads.
However, it doesn’t stop a much simpler variant.
If you define one large entity that contains only raw text (no & characters) and then reference it many times, the parser will happily expand it every time. There is no lim
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-33036 fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass
bugzilla·2026-03-20·CVSS 7.5
CVE-2026-33036 [HIGH] CVE-2026-33036 fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass
CVE-2026-33036 fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, &#xHH;) and standard XML entities completely evade the entity expansion limits (e.g., maxTotalExpansions, maxExpandedLength) added to fix CVE-2026-26278, enabling XML entity expansion Denial of Service. The root cause is that replaceEntitiesValue() in OrderedObjParser.js only enforces expansion counting on DOCTYPE-defined entities while the lastEntities loop handling numeric/standard entities performs no counting at all. An attacker supplying 1M numeric entity references like A can
Bugzilla
CVE-2026-26278 fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion
bugzilla·2026-02-19·CVSS 7.5
CVE-2026-26278 [HIGH] CVE-2026-26278 fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion
CVE-2026-26278 fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.
Bugzilla
CVE-2026-26278 h3: fast-xml-parser: Denial of Service via unlimited XML entity expansion [fedora-42]
bugzilla·2026-02-19·CVSS 7.5
CVE-2026-26278 [HIGH] CVE-2026-26278 h3: fast-xml-parser: Denial of Service via unlimited XML entity expansion [fedora-42]
CVE-2026-26278 h3: fast-xml-parser: Denial of Service via unlimited XML entity expansion [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained versi
Wiz
CVE-2026-26278 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-26278 [HIGH] CVE-2026-26278 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-26278 :
JavaScript vulnerability analysis and mitigation
processEntities: false
Source : NVD
## 7.5
Score
Published February 19, 2026
Severity HIGH
CNA Score 7.5
Affected Technologies
JavaScript
Wolfi
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 8.6
Exploitation Probability (EPSS) N/A
Affected packages and libraries
kibana-9.2
langfuse-2
Sources
NVD
Chainguard Has Fix Added at: Feb 20, 2026
Echo Severity HIGH No Fix Added at: Feb 20, 2026
npm Severity HIGH Has Fix Added at: Feb 18, 2026
MinimOS Severity HIGH Has Fix Added at: Feb 20, 2026
Wolfi Has Fix Added at: Feb 20, 2026
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you
Wiz
CVE-2026-33036 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-33036 [HIGH] CVE-2026-33036 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33036 :
JavaScript vulnerability analysis and mitigation
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, &#xHH;) and standard XML entities completely evade the entity expansion limits (e.g., maxTotalExpansions, maxExpandedLength) added to fix CVE-2026-26278, enabling XML entity expansion Denial of Service. The root cause is that replaceEntitiesValue() in OrderedObjParser.js only enforces expansion counting on DOCTYPE-defined entities while the lastEntities loop handling numeric/standard entities performs no counting at all. An attacker supplying 1M numeric entity references like A can force ~147MB of memory alloc
https://github.com/NaturalIntelligence/fast-xml-parser/commit/910dae5be2de2955e968558fadf6e8f74f117a77https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.6https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jmr7-xgp7-cmfjhttps://access.redhat.com/errata/RHSA-2026:40984https://access.redhat.com/errata/RHSA-2026:41941https://access.redhat.com/errata/RHSA-2026:41944https://access.redhat.com/errata/RHSA-2026:6174https://access.redhat.com/errata/RHSA-2026:6802https://access.redhat.com/errata/RHSA-2026:7110https://access.redhat.com/errata/RHSA-2026:7128https://access.redhat.com/security/cve/CVE-2026-26278https://bugzilla.redhat.com/show_bug.cgi?id=2441120https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26278.json
2026-02-19
Published