fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-26278 · CVE overview and exploitation status

EUVD-2026-7970

GHSA-jmr7-xgp7-cmfj

cve-program · CVE-2026-26278

• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jmr7-xgp7-cmfj
• https://github.com/NaturalIntelligence/fast-xml-parser/commit/910dae5be2de2955e968558fadf6e8f74f117a77
• https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.6

euvd · EUVD-2026-7970

• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jmr7-xgp7-cmfj
• https://github.com/NaturalIntelligence/fast-xml-parser/commit/910dae5be2de2955e968558fadf6e8f74f117a77
• https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.6

nvd · CVE-2026-26278

• https://github.com/NaturalIntelligence/fast-xml-parser/commit/910dae5be2de2955e968558fadf6e8f74f117a77
• https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.6
• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jmr7-xgp7-cmfj
• https://access.redhat.com/errata/RHSA-2026:40984
• https://access.redhat.com/errata/RHSA-2026:41941
• https://access.redhat.com/errata/RHSA-2026:41944
• https://access.redhat.com/errata/RHSA-2026:51349
• https://access.redhat.com/errata/RHSA-2026:6174
• https://access.redhat.com/errata/RHSA-2026:6802
• https://access.redhat.com/errata/RHSA-2026:7110
• https://access.redhat.com/errata/RHSA-2026:7128
• https://access.redhat.com/security/cve/CVE-2026-26278
• https://bugzilla.redhat.com/show_bug.cgi?id=2441120
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26278.json

osv · GHSA-jmr7-xgp7-cmfj

• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jmr7-xgp7-cmfj
• https://nvd.nist.gov/vuln/detail/CVE-2026-26278
• https://github.com/NaturalIntelligence/fast-xml-parser/commit/910dae5be2de2955e968558fadf6e8f74f117a77
• https://github.com/NaturalIntelligence/fast-xml-parser
• https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.6

• fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of enti… · Advisory content revised · 15 Nov 2026