fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

Description

Application crashes with stack overflow when user use XML builder with prserveOrder:true for following or similar input

Cause: arrToStr was not validating if the input is an array or a string and treating all non-array values as text content. What kind of vulnerability is it? Who is impacted?

Recommendation

Update the fast-xml-parser package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 4.0.0-beta.0, < 4.5.4

  >= 5.0.0, < 5.3.8**

• Patched version(s): **4.5.4

  5.3.8**

References

• GHSA-fj3w-jwp8-x2g3
• CVE-2026-27942
• CWE-120
• CAPEC-310
• OWASP 2021-A6

Related Issues

• fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names - CVE-2026-25896
• fast-xml-parser has RangeError DoS Numeric Entities Bug - CVE-2026-25128
• fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026- - CVE-2026-33036
• fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) - CVE-2026-26278

Tags:

npm

fast-xml-parser