Description
Application crashes with stack overflow when user use XML builder with prserveOrder:true for following or similar input
Cause: arrToStr was not validating if the input is an array or a string and treating all non-array values as text content. What kind of vulnerability is it? Who is impacted?
Recommendation
Update the fast-xml-parser package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0-beta.0, < 4.5.4 >= 5.0.0, < 5.3.8** Patched version(s): **4.5.4 5.3.8**
References
Could your website be exposed too?
SmartScanner can check your website for fast-xml-parser has stack overflow in XMLBuilder with preserveOrder and gives you actionable findings to investigate.
Start a free scanRelated Issues
- fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters - CVE-2026-41650
- fast-xml-parser has RangeError DoS Numeric Entities Bug - CVE-2026-25128
- fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names - CVE-2026-25896
- Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser - CVE-2026-33349
You might also like:
See something that needs correcting? Let us knowUpdated March 06, 2026