CVE-2026-27942: fast-xml-parser Buffer Overflow Flaw

CVE-2026-27942 Overview

CVE-2026-27942 is a Denial of Service vulnerability affecting fast-xml-parser, a popular JavaScript library that enables users to validate XML, parse XML to JS objects, or build XML from JS objects without C/C++ based libraries. Prior to version 5.3.8, the application crashes with a stack overflow when users invoke the XML builder with the preserveOrder:true configuration option.

Critical Impact

Applications using fast-xml-parser with preserveOrder:true are vulnerable to denial of service attacks through crafted input that triggers stack overflow conditions, potentially crashing Node.js applications.

Affected Products

• fast-xml-parser versions prior to 5.3.8
• Applications using XML builder functionality with preserveOrder:true option

Discovery Timeline

• 2026-02-26 - CVE-2026-27942 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-27942

Vulnerability Analysis

This vulnerability is classified under CWE-120 (Buffer Copy without Checking Size of Input), though in the JavaScript context it manifests as a stack overflow condition. The root cause lies in how the orderedJs2Xml.js module handles input when the preserveOrder:true option is enabled. The vulnerable code path fails to validate whether the input parameter is an array before iterating over it, leading to recursive processing that can exhaust the call stack.

The attack vector is network-based, meaning attackers can potentially exploit this vulnerability remotely by providing malicious input to web applications that process user-supplied data through the fast-xml-parser library. When exploited, the application crashes completely, resulting in service disruption.

Root Cause

The vulnerability stems from improper input validation in the XML builder's ordered processing mode. When preserveOrder:true is configured, the builder expects array input but does not validate this assumption. Non-array values passed to the builder function trigger recursive behavior that leads to stack exhaustion.

Attack Vector

An attacker can exploit this vulnerability by providing specially crafted non-array input to applications using fast-xml-parser's XML builder with preserveOrder:true. The attack requires no authentication or user interaction and can be delivered over the network through any application interface that accepts data destined for XML building operations.

     let xmlStr = "";
     let isPreviousElementTag = false;
 

+    if (!Array.isArray(arr)) {
+        // Non-array values (e.g. string tag values) should be treated as text content
+        if (arr !== undefined && arr !== null) {
+            let text = arr.toString();
+            text = replaceEntitiesValue(text, options);
+            return text;
+        }
+        return "";
+    }
+
     for (let i = 0; i < arr.length; i++) {
         const tagObj = arr[i];
         const tagName = propName(tagObj);
-        if(tagName === undefined) continue;
+        if (tagName === undefined) continue;
 
         let newJPath = "";
         if (jPath.length === 0) newJPath = tagName

Source: GitHub Commit Update

Detection Methods for CVE-2026-27942

Indicators of Compromise

• Unexpected application crashes with stack overflow error messages in Node.js processes
• Elevated crash rates in services using fast-xml-parser for XML building operations
• Error logs containing "RangeError: Maximum call stack size exceeded" exceptions

Detection Strategies

• Monitor application error logs for stack overflow exceptions originating from fast-xml-parser or orderedJs2Xml.js
• Implement dependency scanning to identify fast-xml-parser versions prior to 5.3.8 in your software bill of materials
• Deploy runtime application self-protection (RASP) solutions to detect recursive function call anomalies

Monitoring Recommendations

• Configure alerting on Node.js process crashes and restarts in production environments
• Implement health check monitoring to detect service availability degradation
• Track CPU and memory utilization spikes that may precede stack overflow crashes

How to Mitigate CVE-2026-27942

Immediate Actions Required

• Upgrade fast-xml-parser to version 5.3.8 or later immediately
• If immediate upgrade is not possible, switch to using preserveOrder:false as a temporary workaround
• Validate and sanitize all input data before passing it to the XML builder function

Patch Information

The vulnerability has been fixed in fast-xml-parser version 5.3.8. The patch adds proper input validation by checking if the input is an array before processing. If non-array values are passed, they are now safely converted to text content rather than triggering recursive processing. The fix can be reviewed in GitHub Pull Request #791 and the GitHub Security Advisory GHSA-fj3w-jwp8-x2g3.

Workarounds

• Configure XML builder with preserveOrder:false if ordered output is not strictly required
• Implement input validation to ensure only array data is passed to the builder when using preserveOrder:true
• Add try-catch blocks around XML builder calls to gracefully handle potential crashes

# Upgrade fast-xml-parser to patched version
npm update fast-xml-parser@5.3.8

# Or install specific version
npm install fast-xml-parser@5.3.8