What is the CVSS score of CVE-2026-27942?

CVE-2026-27942 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Fast Xml Parser are affected by CVE-2026-27942?

A denial-of-service vulnerability in fast-xml-parser versions prior to 5.3.8 can cause application crashes when the XML builder feature is used with specific configuration settings.. A patch is available.

How to fix or mitigate CVE-2026-27942?

Within 24 hours: Identify all applications and services using fast-xml-parser and document current versions in use. Within 7 days: Upgrade fast-xml-parser to version 5.3.8 or later across all development, staging, and production environments, and conduct testing to validate functionality. Within 30 days: Verify patch deployment completion, document the upgrade in change management systems, and review application logs for any exploitation attempts.

Fast Xml Parser CVE-2026-27942

HIGH

Classic Buffer Overflow (CWE-120)

2026-02-26 security-advisories@github.com

GHSA-fj3w-jwp8-x2g3

Stack Overflow Denial Of Service Fast Xml Parser Red Hat

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.5 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Mar 02, 2026 - 14:54 nvd

Patch available

CVE Published

Feb 26, 2026 - 02:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with preserveOrder:true. Version 5.3.8 fixes the issue. As a workaround, use XML builder with preserveOrder:false or check the input data before passing to builder.

AnalysisAI

Stack overflow denial of service in fast-xml-parser versions prior to 5.3.8 occurs when the XML builder is used with the preserveOrder option enabled, causing the application to crash. An attacker can trigger this vulnerability remotely by sending specially crafted XML input, resulting in service unavailability for applications using the affected library. A patch is available in version 5.3.8 and later.

Technical ContextAI

Classified as CWE-120 (Classic Buffer Overflow). Affects Fast-Xml-Parser. fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with preserveOrder:true. Version 5.3.8 fixes the issue. As a workaround, use XML builder with preserveOrder:false or check the input data before passing to builder.

RemediationAI

A vendor patch is available — apply it immediately. Enable ASLR, DEP/NX, and stack canaries where possible. Restrict network access to the affected service where possible.