CVE-2026-27942
highPriorität · verfolgen · 30EPSS 0.005 · 45. PerzentilDEEUUSEPSS · bewertet 2026-10-27
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenSentio Creatorsick_psirt
It is strongly recommended to upgrade the Device Manger Extension to version 1.1.1.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–high · 2.7–7.5
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (9)
Betroffene Produkte und Versionsbereiche.
- naturalintelligence fast-xml-parser< 4.5.4nvdUScpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*
- naturalintelligence fast-xml-parser5.0.0 → 5.3.8nvdUScpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*
- SICK AG Sentio Creator all versions using Device Manager Version 1.1.1≤ all versions using Device Manager Version 1.1.1fixedsick_psirtDE
- SICK AG Sentio Creator all versions using Device Manager Version < 1.1.1≤ all versions using Device Manager Version < 1.1.1sick_psirtDE
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- sca-2026-0014Fast-xml-parser vulnerabilities affect Sentio Creator Extension 'Device Manager'2026-10-14csaf · sick_psirtDE
Multiple vulnerabilities in the third-party component fast-xml-parser affect the Device Manager Extension in Sentio Creator. The extension is maintained and updated independently from SICK Sentio Creator, but successful exploitation of these vulnerabilities could impact the security of the Sentio Creator. SICK strongly recommends upgrading the extension to remediate the identified issues.
- GHSA-fj3w-jwp8-x2g3fast-xml-parser has stack overflow in XMLBuilder with preserveOrder2026-02-26ghsa · osvUS
### Impact Application crashes with stack overflow when user use XML builder with `prserveOrder:true` for following or similar input ``` [{ 'foo': [ { 'bar': [{ '@_V': 'baz' }] } ] }] ``` Cause: `arrToStr` was not validating if the input is an array or a string and treating all non-array values as text content. _What kind of vulnerability is it? Who is impacted?_ ### Patches Yes in 5.3.8 ### Workarounds Use XML builder with `preserveOrder:false` or check the input data before passing to builder. ### References [_Are there any links users can visit to find out more?_](https://github.com/NaturalIntelligence/fast-xml-parser/pull/791)
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (10)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/NaturalIntelligence/fast-xml-parser/commit/c13a961910f14986295dd28484eee830fa1a0e8acnnvd
- https://github.com/NaturalIntelligence/fast-xml-parser/pull/791cnnvd
- https://github.com/NaturalIntelligence/fast-xml-parser/releasesPatchcnnvd
- https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-fj3w-jwp8-x2g3cnnvd
- https://github.com/NaturalIntelligence/fast-xml-parser/commit/c13a961910f14986295dd28484eee830fa1a0e8aenisa_euvd
- https://github.com/NaturalIntelligence/fast-xml-parser/pull/791enisa_euvd
- https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-fj3w-jwp8-x2g3enisa_euvd
- https://github.com/NaturalIntelligence/fast-xml-parser/commit/c13a961910f14986295dd28484eee830fa1a0e8aPatchnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan