CVE-2026-26278
XML Entity Expansion Vulnerability in fast-xml-parser Causes Denial of Service
Publication date: 2026-02-19
Last updated on: 2026-02-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| naturalintelligence | fast-xml-parser | From 4.1.3 (inc) to 5.3.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-776 | The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade fast-xml-parser to version 5.3.6 or later, where the issue is fixed.
As a workaround, avoid using DOCTYPE parsing by setting the option `processEntities: false` in your XML parser configuration.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
Can you explain this vulnerability to me?
The vulnerability exists in the fast-xml-parser library versions 4.1.3 through 5.3.5. It allows an attacker to force the XML parser to perform an unlimited amount of entity expansion. This means that with a very small XML input, the parser can be made to spend an excessive amount of time processing a single request, potentially freezing the application.
This happens because the parser does not properly limit entity expansion, leading to a denial of service condition. The issue is fixed in version 5.3.6, and a workaround is to disable DOCTYPE parsing by setting the option `processEntities: false`.
How can this vulnerability impact me? :
This vulnerability can impact you by causing a denial of service (DoS) condition. An attacker can send a specially crafted XML input that forces the parser to perform excessive entity expansions, causing the application to freeze or become unresponsive for seconds or even minutes.
This can lead to service outages, degraded performance, and potentially impact availability of your application or service that uses the fast-xml-parser library.