CVE-2026-126066

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData() in OrderedObjParser.js calls readTagExp() for each less-than character in an unterminated stop-node body and repeatedly rescans the remaining input while looking for a closing greater-than character. An attacker who supplies XML containing many tag fragments without a later closing character can cause quadratic rescanning before parsing fails, blocking a Node.js event loop and causing CPU-exhaustion denial of service. This issue is fixed in version 5.12.0.

• https://github.com/NaturalIntelligence/fast-xml-parser/commit/0c3659348364959da62954b73728fb3bd05ebcb4
• https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.12.0
• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-474x-hrwr-fgx4

• https://github.com/NaturalIntelligence/fast-xml-parser/commit/0c3659348364959da62954b73728fb3bd05ebcb4
• https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.12.0
• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-474x-hrwr-fgx4

• HIGHCVE-2019-25781PoC
• HIGHCVE-2026-100700PoC
• HIGHCVE-2026-101021PoC
• MEDIUMCVE-2026-102277PoC
• MEDIUMCVE-2026-102461PoC
• HIGHCVE-2026-102994PoC
• HIGHCVE-2026-102997PoC
• HIGHCVE-2026-102999PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.