CVE-2026-26278: fast-xml-parser DoS Vulnerability

CVE-2026-26278 Overview

CVE-2026-26278 is a Denial of Service vulnerability affecting fast-xml-parser, a popular JavaScript library that allows users to validate XML, parse XML to JavaScript objects, or build XML from JavaScript objects without C/C++ based libraries and no callback. The vulnerability exists in versions 4.1.3 through 5.3.5, where the XML parser can be forced to perform an unlimited amount of entity expansion.

Critical Impact

With a very small XML input, attackers can make the parser spend seconds or even minutes processing a single request, effectively freezing the application and causing a complete denial of service.

Affected Products

• fast-xml-parser versions 4.1.3 through 5.3.5

Discovery Timeline

• 2026-02-19 - CVE CVE-2026-26278 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-26278

Vulnerability Analysis

This vulnerability is classified as CWE-776 (Improper Restriction of Recursive Entity References in DTDs), commonly known as an "XML Bomb" or "Billion Laughs Attack." The fast-xml-parser library fails to properly limit entity expansion when processing Document Type Definitions (DTDs) in XML documents.

When the parser encounters nested entity definitions, it recursively expands these entities without adequate bounds checking. An attacker can craft a malicious XML document containing deeply nested entity references that, when expanded, consume exponential amounts of memory and CPU resources. This asymmetric attack characteristic means a payload of just a few kilobytes can expand to gigabytes of data, overwhelming application resources.

The vulnerability is exploitable over the network, requires no authentication, and can be triggered with minimal attacker complexity, making it particularly dangerous for applications that parse untrusted XML input.

Root Cause

The root cause lies in the entity processing logic within fast-xml-parser's DOCTYPE handling. When processEntities is enabled (the default behavior), the parser expands entity references without imposing limits on recursion depth or the total number of entity expansions. This allows crafted XML documents with recursive or exponentially expanding entity definitions to consume unbounded resources.

Attack Vector

The attack vector is network-based, where an attacker submits a specially crafted XML document to any endpoint that uses fast-xml-parser. The malicious XML contains nested entity definitions that trigger exponential expansion during parsing.

A typical attack payload would define multiple entities where each entity references another entity multiple times. For example, an entity a might expand to multiple references of entity b, which in turn expands to multiple references of entity c, and so on. This creates an exponential explosion in processing time and memory consumption.

The attack requires no special privileges and no user interaction, making it trivial to exploit against vulnerable applications that accept XML input from untrusted sources.

Detection Methods for CVE-2026-26278

Indicators of Compromise

• Sudden spikes in CPU utilization on servers processing XML data
• Memory exhaustion events correlating with XML parsing operations
• Application timeouts or unresponsive endpoints that handle XML input
• Log entries showing extended processing times for XML parsing functions

Detection Strategies

• Monitor application performance metrics for anomalous resource consumption during XML processing
• Implement request timeout monitoring to detect parsing operations exceeding normal thresholds
• Audit codebase dependencies to identify fast-xml-parser versions between 4.1.3 and 5.3.5
• Deploy web application firewall rules to detect XML payloads containing suspicious DOCTYPE declarations with nested entities

Monitoring Recommendations

• Configure alerting for abnormal CPU and memory usage patterns in Node.js applications
• Implement application-level logging around XML parsing operations to track processing duration
• Set up dependency scanning in CI/CD pipelines to flag vulnerable fast-xml-parser versions
• Monitor for repeated requests containing XML payloads to the same endpoints

How to Mitigate CVE-2026-26278

Immediate Actions Required

• Upgrade fast-xml-parser to version 5.3.6 or later immediately
• If immediate upgrade is not possible, disable DOCTYPE processing by setting processEntities: false
• Review all application endpoints that accept XML input and assess exposure
• Implement request timeouts and resource limits for XML parsing operations

Patch Information

The vulnerability has been fixed in fast-xml-parser version 5.3.6. The fix is available via the GitHub Release v5.3.6. Technical details of the patch can be reviewed in the GitHub Commit. Additional context is available in the GitHub Security Advisory GHSA-jmr7-xgp7-cmfj.

Workarounds

• Disable entity processing by configuring processEntities: false in the parser options
• Implement input validation to reject XML documents containing DOCTYPE declarations
• Set strict timeouts on XML parsing operations to prevent resource exhaustion
• Consider using alternative XML parsers with built-in entity expansion limits for untrusted input

// Workaround configuration to disable DOCTYPE processing
const { XMLParser } = require('fast-xml-parser');

const parser = new XMLParser({
  processEntities: false
});