CVE-2026-26278

Fixed in a distro release EPSS <1%CVSS 7.5

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.

Published 2026-02-19 · CVE record · OSV

Products: NaturalIntelligence fast-xml-parser, Red Hat Advanced Cluster Security 4.8, Red Hat Advanced Cluster Security 4.9, Red Hat Developer Hub 1.8, Red Hat Developer Hub 1.9, Red Hat Openshift Data Foundation 4.18, Red Hat Openshift Data Foundation 4.19, Red Hat Openshift Data Foundation 4.20, Red Hat Satellite 6.18, Red Hat Migration Toolkit for Applications 8, Red Hat OpenShift GitOps, Red Hat OpenShift Virtualization 4, Red Hat Satellite 6, Red Hat Self-service automation portal 2

Fixed upstream

Distro releases