CVE-2026-126066 fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-126066?
CVE-2026-126066 is a low-severity vulnerability in NaturalIntelligence fast-xml-parser, published on 10 Nov 2026.
Official description
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData() in OrderedObjParser.js calls readTagExp() for each less-than character in an unterminated stop-node body and repeatedly rescans the remaining input while looking for a closing greater-than character. An attacker who supplies XML containing many tag fragments without a later closing character can cause quadratic rescanning before parsing fails, blocking a Node.js event loop and causing CPU-exhaustion denial of service. This issue is fixed in version 5.12.0.
Weakness: CWE-407
Which versions are affected by CVE-2026-126066?
1 open source package ship an affected version, including fast-xml-parser.
| Package | Affected | Fixed in |
|---|---|---|
fast-xml-parser npm | All versions | 5.12.0 |
How do I fix CVE-2026-126066?
Upgrade fast-xml-parser to 5.12.0 or later.
Is CVE-2026-126066 being exploited?
There is no known exploitation of CVE-2026-126066 in the wild and no public exploit code.
Sources
Also known as GHSA-474x-hrwr-fgx4.