Skip to content
Fencer Intel
high 7.5

CVE-2026-26278 json

fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

published 8mo ago modified last mo. also EUVD-2026-7970 , GHSA-jmr7-xgp7-cmfj

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 61%
public exploits
0
none known

Summary

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.

Patch / fix

  • npm fast-xml-parser 4.5.4, 5.3.6
  • Red Hat Red Hat Advanced Cluster Security 4.8 1775594119
  • Red Hat Red Hat Advanced Cluster Security 4.9 1775594284
  • Red Hat Red Hat Developer Hub 1.8 1774545605
  • Red Hat Red Hat Developer Hub 1.9 1775140647
  • Red Hat Red Hat Openshift Data Foundation 4.18 1783676191, 1783676585, 1783676649, 1783676675, 1783676820, 1783676883, 1783676894, 1783676977, 1783677297, 1783677345, 1783677533, 1783929816, 1784093503, 1784093953, 1784094299, 1784094353, 1784094725, 1784094943, 1784095175
  • Red Hat Red Hat Openshift Data Foundation 4.19 1783684068, 1783684360, 1783684603, 1783684667, 1783684668, 1783684707, 1783684779, 1783684831, 1783684839, 1783685128, 1783685129, 1783685375, 1784054582, 1784054606, 1784054873, 1784055295, 1784055533, 1784055558, 1784055589, 1784056134
  • Red Hat Red Hat Openshift Data Foundation 4.20 1783666755, 1783667125, 1783667517, 1783667577, 1783667611, 1783667641, 1783667790, 1783667859, 1783667869, 1783667875, 1783667877, 1783668266, 1784054598, 1784055020, 1784055244, 1784055382, 1784055387, 1784055576, 1784055586, 1784055726
  • Red Hat Red Hat Satellite 6.18 1785922764
  • velociraptor openSUSE Tumbleweed 0.7.0.4.git185.a5708584-2.1
  • heroic-games-launcher openSUSE Tumbleweed 2.20.0-1.1

opensuse advisories openSUSE-SU-2026:11126-1openSUSE-SU-2026:10236-1

Is CVE-2026-26278 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-26278 updated cvss 7.5

fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion

  • Red Hat Migration Toolkit for Applications 8 mta/mta-ui-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal
    affected: workaround, no fix available
  • Red Hat Advanced Cluster Security 4.8 advanced-cluster-security 1775594119
    fixed: vendor fix RHSA-2026:7110
  • Red Hat Advanced Cluster Security 4.9 advanced-cluster-security 1775594284
    fixed: vendor fix RHSA-2026:7128
  • Red Hat Developer Hub 1.8 rhdh 1774545605
    fixed: vendor fix RHSA-2026:6174
  • Red Hat Developer Hub 1.9 rhdh 1775140647
    fixed: vendor fix RHSA-2026:6802
  • Red Hat Openshift Data Foundation 4.18 odf4/cephcsi-rhel9 1783676191, odf4/odf-cli-rhel9 1784094299, odf4/mcg-core-rhel9 1784094353, odf4/odf-console-rhel9 1784094725, odf4/mcg-rhel9-operator 1784093953, odf4/ocs-rhel9-operator 1783676675, +13 more
    fixed: vendor fix RHSA-2026:41941
show 5 more
  • Red Hat Openshift Data Foundation 4.19 odf4/cephcsi-rhel9 1783684360, odf4/odf-cli-rhel9 1784054873, odf4/mcg-core-rhel9 1784054582, odf4/odf-console-rhel9 1784055589, odf4/mcg-rhel9-operator 1784054606, odf4/ocs-rhel9-operator 1783684667, +14 more
    fixed: vendor fix RHSA-2026:41944
  • Red Hat Openshift Data Foundation 4.20 odf4/cephcsi-rhel9 1783667125, odf4/odf-cli-rhel9 1784055020, odf4/mcg-core-rhel9 1784054598, odf4/odf-console-rhel9 1784055586, odf4/mcg-rhel9-operator 1784055387, odf4/ocs-rhel9-operator 1783667611, +16 more
    fixed: vendor fix RHSA-2026:40984
  • Red Hat Satellite 6.18 satellite/iop-host-inventory-frontend-rhel9 1785922764
    fixed: vendor fix RHSA-2026:51349
  • Red Hat Advanced Cluster Security 4.8 advanced-cluster-security 1774163438, advanced-cluster-security 1774294180, advanced-cluster-security 1775594119 Red Hat Advanced Cluster Security 4.9 advanced-cluster-security 1774260292, advanced-cluster-security 1774294136, advanced-cluster-security 1775594284 Red Hat Developer Hub 1.8 rhdh 1774544220, rhdh 1774549552 Red Hat Developer Hub 1.9 rhdh 1775140369, rhdh 1775155242 Red Hat Openshift Data Foundation 4.18 odf4/mcg-operator-bundle 1784096858, odf4/ocs-operator-bundle 1784097072, odf4/odf-operator-bundle 1784097342, odf4/cephcsi-operator-bundle 1784096750, odf4/odr-hub-operator-bundle 1784097501, odf4/rook-ceph-operator-bundle 1784098364, +7 more Red Hat Openshift Data Foundation 4.19 odf4/mcg-operator-bundle 1784058120, odf4/ocs-operator-bundle 1784058383, odf4/odf-operator-bundle 1784058758, odf4/cephcsi-operator-bundle 1784057956, odf4/odr-hub-operator-bundle 1784058873, odf4/rook-ceph-operator-bundle 1784059042, +7 more
    +1 more products
    Red Hat Openshift Data Foundation 4.20 odf4/mcg-operator-bundle 1784058849, odf4/ocs-operator-bundle 1784059112, odf4/odf-operator-bundle 1784060452, odf4/cephcsi-operator-bundle 1784058684, odf4/odr-hub-operator-bundle 1784060213, odf4/rook-ceph-operator-bundle 1784059800, +8 more
    not affected: vulnerable code not present
  • Red Hat Satellite 6 satellite/iop-vulnerability-frontend-rhel9
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
8mo ago

Exploit prediction

0.94% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jmr7-xgp7-cmfj referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm fast-xml-parser
>=4.1.3, <4.5.4
>=5.0.0, <5.3.6
4.5.4
5.3.6

Affected products

  • NaturalIntelligence fast-xml-parser
  • Red Hat Red Hat Advanced Cluster Security 4.8
  • Red Hat Red Hat Advanced Cluster Security 4.9
  • Red Hat Red Hat Developer Hub 1.8
  • Red Hat Red Hat Developer Hub 1.9
  • Red Hat Red Hat Openshift Data Foundation 4.18
  • Red Hat Red Hat Openshift Data Foundation 4.19
  • Red Hat Red Hat Openshift Data Foundation 4.20
  • Red Hat Red Hat Satellite 6.18
  • Red Hat Migration Toolkit for Applications 8
  • Red Hat Red Hat OpenShift GitOps
  • Red Hat Red Hat OpenShift Virtualization 4
  • Red Hat Red Hat Satellite 6
  • Red Hat Self-service automation portal 2

Classification

Weakness
  • CWE-776 Improper Restriction of Recursive Entity References in DTDs

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.