Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦 npm
Not in CISA KEV

CVE-2026-27942 — fast-xml-parser

Fix: NaturalIntelligence/fast-xml-parser@c13a961

CVE-2026-27942 is a CWE-120 vulnerability in fast-xml-parser. A fix is available for fast-xml-parser — see the affected versions and patch details below.

fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

Also known asGHSA-fj3w-jwp8-x2g3
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Oct 14, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-27942.

EPSS Exploitation Probability

via FIRST.org ↗
0.7%probability of exploitation in next 30 days
Lower Risk+0.18%
Lower risk than most CVEs50th percentile — riskier than 50% of all scored CVEsHighest risk
0.00%0.39%0.77%1.16%0.1%0.7%Apr 26Jul 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

2 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

6Kother npm packages depend on this — each one inherits the vulnerability until it's patched upstream
fast-xml-parsernpm
83.5Mdownloads / week

Description

Impact

Application crashes with stack overflow when user use XML builder with prserveOrder:true for following or similar input

[{
    'foo': [
        { 'bar': [{ '@_V': 'baz' }] }
    ]
}]

Cause: arrToStr was not validating if the input is an array or a string and treating all non-array values as text content. What kind of vulnerability is it? Who is impacted?

Patches

Yes in 5.3.8

Workarounds

Use XML builder with preserveOrder:false or check the input data before passing to builder.

References

Are there any links users can visit to find out more?

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
📦npmfast-xml-parser≥ 5.0.0&&< 5.3.85.3.8npm install fast-xml-parser@5.3.8
📦npmfast-xml-parser≥ 4.0.0-beta.0&&< 4.5.44.5.4npm install fast-xml-parser@4.5.4

Affected Products

1 product · 2 configurations
Application
fast-xml-parsernaturalintelligence
≥ 5.0.0 && < 5.3.8
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for fast-xml-parser, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update fast-xml-parser to 5.3.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-27942 is resolved across your whole dependency graph.

  3. Workarounds

    Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate

The flaw affects the XML builder component of the fast-xml-parser library and is triggered only when the preserveOrder option is explicitly enabled. In Red Hat–shipped configurations, this option is not enabled by default, and the vulnerable code path is therefore not exercised under typical deployments. The…

Workaround published by Red Hat
To mitigate this vulnerability, configure applications using the `fast-xml-parser` XML builder to set the `preserveOrder` option to `false`. Alternatively, ensure that all XML input data is thoroughly validated before being passed to the builder to prevent the processing of malicious or malformed content.
Source: Red Hat security advisory for CVE-2026-27942 (CC BY 4.0)
ProductFixed inAdvisory
Red Hat Advanced Cluster Security 4.8advanced-cluster-security/rhacs-main-rhel8:1775594119RHSA-2026:7110
Red Hat Advanced Cluster Security 4.9advanced-cluster-security/rhacs-main-rhel8:1775594284RHSA-2026:7128
Red Hat Developer Hub 1.8rhdh/rhdh-hub-rhel9:1774545605RHSA-2026:6174
Red Hat Developer Hub 1.9rhdh/rhdh-hub-rhel9:1775140647RHSA-2026:6802
Red Hat Openshift Data Foundation 4.18odf4/cephcsi-rhel9:1783676191RHSA-2026:41941
Red Hat Openshift Data Foundation 4.19odf4/cephcsi-rhel9:1783684360RHSA-2026:41944
Red Hat Openshift Data Foundation 4.20odf4/cephcsi-rhel9:1775822432RHSA-2026:12277
Red Hat Openshift Data Foundation 4.20odf4/cephcsi-rhel9:1783667125RHSA-2026:40984

Frequently Asked Questions

### Impact Application crashes with stack overflow when user use XML builder with `prserveOrder:true` for following or similar input ``` [{ 'foo': [ { 'bar': [{ '@_V': 'baz' }] } ] }] ``` Cause: `arrToStr` was not validating if the input is an array or a string and treating all non-array values as text content. _What kind of vulnerability is it? Who is impacted?_ ### Patches Yes in 5.3.8 ### Workarounds Use XML builder with `preserveOrder:false` or check the input data before passing to builder. ### References [_Are there any links users can visit to find out more?_](http
O3 Security · Impact-Aware SCA

Is CVE-2026-27942 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-27942: fast-xml-parser — Fixed in 5.3.8