Vulnerability GHSA-fj3w-jwp8-x2g3
Low Risk
LOW RISK
CVSS Score: 3.0
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
8 months ago
February 26, 2026 at 10:33 PM UTC
fast-xml-parser has stack overflow in XMLBuilder with preserveOrder
>=5.0.0 <5.3.8, >=4.0.0-beta.0 <4.5.4
>=5.0.0 <5.3.8, >=4.0.0-beta.0 <4.5.4
Summary
fast-xml-parser has stack overflow in XMLBuilder with preserveOrder
Details
Impact
Application crashes with stack overflow when user use XML builder with prserveOrder:true for following or similar input
[{
'foo': [
{ 'bar': [{ '@_V': 'baz' }] }
]
}]
Cause: arrToStr was not validating if the input is an array or a string and treating all non-array values as text content. What kind of vulnerability is it? Who is impacted?
Patches
Yes in 5.3.8
Workarounds
Use XML builder with preserveOrder:false or check the input data before passing to builder.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
11 hours ago
fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags
<5.12.0 GHSA-474x-hrwr-fgx4
<5.12.0 GHSA-474x-hrwr-fgx4
High Risk
3 months ago
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
>=5.9.3 <5.10.1 GHSA-8r6m-32jq-jx6q
>=5.9.3 <5.10.1 GHSA-8r6m-32jq-jx6q
Medium Risk
6 months ago
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
<5.7.0 GHSA-gh4j-gqv2-49f6
<5.7.0 GHSA-gh4j-gqv2-49f6
Medium Risk
7 months ago
Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser
>=4.0.0-beta.3 <4.5.5, >=5.0.0 <5.5.7 GHSA-jp2q-39xq-3w4g
>=4.0.0-beta.3 <4.5.5, >=5.0.0 <5.5.7 GHSA-jp2q-39xq-3w4g
High Risk
7 months ago
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
>=5.0.0 <5.5.6, >=4.0.0-beta.3 <4.5.5 GHSA-8gc5-j5rx-235r
>=5.0.0 <5.5.6, >=4.0.0-beta.3 <4.5.5 GHSA-8gc5-j5rx-235r
Impacted packages
Timeline
Published
8 months ago
February 26, 2026 at 10:33 PM UTC
Fixed (5.3.8)
8 months ago
February 25, 2026 at 05:06 AM UTC
Fixed (4.5.4)
8 months ago
February 26, 2026 at 05:12 AM UTC
Last Modified
2 months ago
September 10, 2026 at 03:50 AM UTC