{"id":"CVE-2026-27942","aliases":["GHSA-fj3w-jwp8-x2g3"],"url":"https://o3.security/vulnerability/CVE-2026-27942","summary":"fast-xml-parser has stack overflow in XMLBuilder with preserveOrder","details":"### Impact\nApplication crashes with stack overflow when user use XML builder with `prserveOrder:true` for following or similar input \n\n```\n[{\n    'foo': [\n        { 'bar': [{ '@_V': 'baz' }] }\n    ]\n}]\n```\n\nCause: `arrToStr` was not validating if the input is an array or a string and treating all non-array values as text content.\n_What kind of vulnerability is it? Who is impacted?_\n\n### Patches\nYes in 5.3.8\n\n### Workarounds\nUse XML builder with `preserveOrder:false` or check the input data before passing to builder.\n\n### References\n[_Are there any links users can visit to find out more?_](https://github.com/NaturalIntelligence/fast-xml-parser/pull/791)","published":"2026-02-26T01:22:11.383Z","modified":"2026-08-12T03:51:14.932852312Z","cvss":null,"epss":{"score":0.00478,"percentile":0.40276,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"fast-xml-parser","fixedVersion":"5.3.8"},{"ecosystem":"npm","name":"fast-xml-parser","fixedVersion":"4.5.4"}],"fix":{"url":"https://github.com/NaturalIntelligence/fast-xml-parser/commit/c13a961910f14986295dd28484eee830fa1a0e8a","label":"NaturalIntelligence/fast-xml-parser@c13a961"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27942.json"},{"type":"ADVISORY","url":"https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-fj3w-jwp8-x2g3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27942"},{"type":"FIX","url":"https://github.com/NaturalIntelligence/fast-xml-parser/commit/c13a961910f14986295dd28484eee830fa1a0e8a"},{"type":"FIX","url":"https://github.com/NaturalIntelligence/fast-xml-parser/pull/791"},{"type":"PACKAGE","url":"https://github.com/NaturalIntelligence/fast-xml-parser"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:14.932852312Z"}}