CVE-2026-26278 — fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

Affected: NaturalIntelligence fast-xml-parser, Red Hat Advanced Cluster Security 4.8, Red Hat Advanced Cluster Security 4.9, Red Hat Developer Hub 1.8, Red Hat Developer Hub 1.9, Red Hat Openshift Data Foundation 4.18, Red Hat Openshift Data Foundation 4.19, Red Hat Openshift Data Foundation 4.20, Red Hat Satellite 6.18, Red Hat Migration Toolkit for Applications 8 and 4 more

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.

Most recent entries from all

CVE-2026-26278 — fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)