CVE-2026-27942
Fixed in a distro release EPSS <1%CVSS 2.7
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder.
Products: NaturalIntelligence fast-xml-parser
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | fast-xml-parser | 5.3.8 |
| npm | fast-xml-parser | 4.5.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | no fix |
| Chainguard | airflow-core-2 | no fix |
| Chainguard | dbgate | 7.1.2-r1 |
| Chainguard | dbgate-fips | 7.1.2-r0 |
| Chainguard | jitsucom-jitsu-console | 2.11.0-r16 |
| Chainguard | kibana-8.17 | 8.17.10-r11 |
| Chainguard | kibana-8.17-iamguarded | 8.17.10-r11 |
| Chainguard | kibana-8.18 | no fix |
| Chainguard | kibana-8.18-bitnami | no fix |
| Chainguard | kibana-8.18-iamguarded | no fix |
| Chainguard | kibana-8.19 | 8.19.12-r3 |
| Chainguard | kibana-8.19-bitnami | 8.19.12-r3 |
| Chainguard | kibana-8.19-iamguarded | 8.19.12-r3 |
| Chainguard | kibana-9.0 | 9.0.8-r11 |
| Chainguard | kibana-9.0-iamguarded | 9.0.8-r11 |
| Chainguard | kibana-9.1 | 9.1.10-r6 |
| Chainguard | kibana-9.1-iamguarded | 9.1.10-r6 |
| Chainguard | kibana-9.2 | 9.2.6-r2 |
| Chainguard | kibana-9.2-iamguarded | 9.2.6-r2 |
| Chainguard | kibana-9.3 | 9.3.1-r1 |
| Chainguard | kibana-9.3-iamguarded | 9.3.1-r1 |
| Chainguard | kubeflow-pipelines-frontend | 2.16.0-r2 |
| Chainguard | langfuse-2-worker | 2.95.12-r12 |
| Chainguard | langfuse-fips-3.152 | no fix |
| Chainguard | langfuse-fips-3.152-worker | no fix |
| Chainguard | librechat | 0.8.2-r6 |
| Chainguard | nextcloud-server-31 | no fix |
| Chainguard | opensearch-dashboards-3 | 3.5.0-r3 |
| Chainguard | opensearch-dashboards-3-fips | 3.5.0-r2 |
| Chainguard | prism | 5.14.3-r8 |
| Chainguard | renovate | 43.48.3-r0 |
| Chainguard | saf | 1.6.0-r0 |
| Chainguard | tileserver-gl | 5.5.0-r6 |
| Chainguard | tileserver-gl-fips | 5.5.0-r7 |
| Debian 12 | node-webfont | no fix |
| Debian 13 | node-webfont | no fix |
| Debian 14 | node-webfont | no fix |
| Ubuntu 24.04 LTS | node-webfont | no fix |
| Ubuntu 25.10 | node-webfont | no fix |
| Ubuntu 26.04 LTS | node-webfont | no fix |
| Ubuntu 26.10 | node-webfont | no fix |
| Wolfi | jitsucom-jitsu-console | 2.11.0-r16 |
| Wolfi | kubeflow-pipelines-frontend | 2.16.0-r2 |
| Wolfi | opensearch-dashboards-3 | 3.5.0-r3 |
| Wolfi | prism | 5.14.3-r8 |
| Wolfi | renovate | 43.48.3-r0 |
| Wolfi | saf | 1.6.0-r0 |
| Wolfi | tileserver-gl | 5.5.0-r6 |