CVE-2026-27942: fast-xml-parser has stack overflow in XMLBuilder with preserveOrder
Impact Application crashes with stack overflow when user use XML builder with prserveOrder:true for following or similar input:
[{ 'foo': [ { 'bar': [{ '@V': 'baz' }] } ] }]
Cause: arrToStr was not validating if the input is an array or a string and treating all non-array values as text content. What kind of vulnerability is it? Who is impacted?
Patches Yes, in 5.3.8 and 4.5.4.
Workarounds Use XML builder with preserveOrder:false or check the input data before passing to builder.
Other sources
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with preserveOrder:true. Version 5.3.8 fixes the issue. As a workaround, use XML builder with preserveOrder:false or check the input data before passing to builder.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27942?
The severity of CVE-2026-27942 is classified as critical due to the potential for application crashes resulting from stack overflow.
How do I fix CVE-2026-27942?
To fix CVE-2026-27942, upgrade fast-xml-parser to version 5.3.8 or later.
What causes the stack overflow in CVE-2026-27942?
The stack overflow in CVE-2026-27942 is caused by the arrToStr function not handling inputs correctly when preserveOrder is set to true.
Which versions of fast-xml-parser are affected by CVE-2026-27942?
CVE-2026-27942 affects fast-xml-parser versions prior to 5.3.8.
In what scenarios should I be concerned about CVE-2026-27942?
You should be concerned about CVE-2026-27942 if your application uses fast-xml-parser with XMLBuilder configured with preserveOrder set to true.