fast-xml-parser has stack overflow in XMLBuilder with preserveOrder
### Impact Application crashes with stack overflow when user use XML builder with `prserveOrder:true` for following or similar input ``` [{ 'foo': [ { 'bar': [{ '@_V': 'baz' }] } ] }] ``` Cause: `arrToStr` was not validating if the input is an array or a string and treating all non-array values as text content. _What kind of vulnerability is it? Who is impacted?_ ### Patches Yes in 5.3.8 ### Workarounds Use XML builder with `preserveOrder:false` or check the input data before passing to builder. ### References [_Are there any links users can visit to find out more?_](https://github.com/NaturalIntelligence/fast-xml-parser/pull/791)
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-27942US | high7.5 | — | ||
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the applica… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/NaturalIntelligence/fast-xml-parserPACKAGE
- https://github.com/NaturalIntelligence/fast-xml-parser/commit/c13a961910f14986295dd28484eee830fa1a0e8aWEB
- https://github.com/NaturalIntelligence/fast-xml-parser/pull/791WEB
- https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-fj3w-jwp8-x2g3WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-27942ADVISORY
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan