fast-xml-parser XML Entity Expansion DoS 4.1.3-5.3.5
CVE-2026-26278 Published on February 19, 2026

fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, its possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.

Github Repository Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-26278 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

NONE

Integrity Impact:

NONE

Availability Impact:

HIGH

Weakness Type

What is a XEE Vulnerability?

The software uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities. If the DTD contains a large number of nested or recursive entities, this can lead to explosive growth of data when parsed, causing a denial of service.

CVE-2026-26278 has been classified to as a XEE vulnerability or weakness.

Products Associated with CVE-2026-26278

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Advanced Cluster Security

Red Hat Rhdh

Red Hat Migration Toolkit Applications

Red Hat Openshift Data Foundation

Red Hat Openshift Gitops

Red Hat Container Native Virtualization

Red Hat Satellite

Red Hat Ansible Portal

Affected Versions

NaturalIntelligence fast-xml-parser:

Version >= 5.0.0, < 5.3.6 is affected.
Version >= 4.1.3, < 4.5.4 is affected.

Red Hat Advanced Cluster Security 4.8:

Version 1775594119 and below * is unaffected.

Red Hat Advanced Cluster Security 4.9:

Version 1775594284 and below * is unaffected.

Red Hat Developer Hub 1.8:

Version 1774545605 and below * is unaffected.

Red Hat Developer Hub 1.9:

Version 1775140647 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1783676191 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1783929816 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1784094353 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1784093953 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1784094943 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1783676585 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1783676649 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1783676675 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1784094299 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1784094725 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1783676820 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1783676883 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1783676894 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1784095175 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1783676977 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1784093503 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1783677297 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1783677345 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1783677533 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1783684360 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1783684068 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1784054582 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1784054606 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1784055295 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1783684603 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1783684668 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1783684667 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1784054873 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1783684707 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1784055589 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1783684779 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1783684831 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1783684839 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1784055533 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1784055558 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1784056134 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1783685128 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1783685129 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1783685375 and below * is unaffected.