CVE-2026-126066fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags

Beschreibung

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData() in OrderedObjParser.js calls readTagExp() for each less-than character in an unterminated stop-node body and repeatedly rescans the remaining input while looking for a closing greater-than character. An attacker who supplies XML containing many tag fragments without a later closing character can cause quadratic rescanning before parsing fails, blocking a Node.js event loop and causing CPU-exhaustion denial of service. This issue is fixed in version 5.12.0.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-474x-hrwr-fgx4
• https://github.com/NaturalIntelligence/fast-xml-parser/commit/0c3659348364959da62954b73728fb3bd05ebcb4
• https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.12.0