GitStock

naturalintelligence/fast-xml-parser · Security

fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

GHSA ID
GHSA-fj3w-jwp8-x2g3
CVE ID
CVE-2026-27942
Severity
low
Published
Updated
CVSS v4
2.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

Description

Impact

Application crashes with stack overflow when user use XML builder with prserveOrder:true for following or similar input

[{
    'foo': [
        { 'bar': [{ '@_V': 'baz' }] }
    ]
}]

Cause: arrToStr was not validating if the input is an array or a string and treating all non-array values as text content. What kind of vulnerability is it? Who is impacted?

Patches

Yes in 5.3.8

Workarounds

Use XML builder with preserveOrder:false or check the input data before passing to builder.

References

Are there any links users can visit to find out more?

CWEs

  • CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

References

Open GitHub