CVE-2026-26278: fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
(updated )
The XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application.
References
- github.com/NaturalIntelligence/fast-xml-parser
- github.com/NaturalIntelligence/fast-xml-parser/commit/910dae5be2de2955e968558fadf6e8f74f117a77
- github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.6
- github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jmr7-xgp7-cmfj
- github.com/advisories/GHSA-jmr7-xgp7-cmfj
- nvd.nist.gov/vuln/detail/CVE-2026-26278
Code Behaviors & Features
Detect and mitigate CVE-2026-26278 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →