CVE-2026-27942
highpriority · track · 30EPSS 0.005 · 45 %ileDEEUUSEPSS · scored 2026-10-27
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSentio Creatorsick_psirt
It is strongly recommended to upgrade the Device Manger Extension to version 1.1.1.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 2.7–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (9)
Products and version ranges known to be affected.
- naturalintelligence fast-xml-parser< 4.5.4nvdUScpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*
- naturalintelligence fast-xml-parser5.0.0 → 5.3.8nvdUScpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*
- SICK AG Sentio Creator all versions using Device Manager Version 1.1.1≤ all versions using Device Manager Version 1.1.1fixedsick_psirtDE
- SICK AG Sentio Creator all versions using Device Manager Version < 1.1.1≤ all versions using Device Manager Version < 1.1.1sick_psirtDE
advisories (2)
Vendor and ecosystem advisories describing this.
- sca-2026-0014Fast-xml-parser vulnerabilities affect Sentio Creator Extension 'Device Manager'2026-10-14csaf · sick_psirtDE
Multiple vulnerabilities in the third-party component fast-xml-parser affect the Device Manager Extension in Sentio Creator. The extension is maintained and updated independently from SICK Sentio Creator, but successful exploitation of these vulnerabilities could impact the security of the Sentio Creator. SICK strongly recommends upgrading the extension to remediate the identified issues.
- GHSA-fj3w-jwp8-x2g3fast-xml-parser has stack overflow in XMLBuilder with preserveOrder2026-02-26ghsa · osvUS
### Impact Application crashes with stack overflow when user use XML builder with `prserveOrder:true` for following or similar input ``` [{ 'foo': [ { 'bar': [{ '@_V': 'baz' }] } ] }] ``` Cause: `arrToStr` was not validating if the input is an array or a string and treating all non-array values as text content. _What kind of vulnerability is it? Who is impacted?_ ### Patches Yes in 5.3.8 ### Workarounds Use XML builder with `preserveOrder:false` or check the input data before passing to builder. ### References [_Are there any links users can visit to find out more?_](https://github.com/NaturalIntelligence/fast-xml-parser/pull/791)
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/NaturalIntelligence/fast-xml-parser/commit/c13a961910f14986295dd28484eee830fa1a0e8acnnvd
- https://github.com/NaturalIntelligence/fast-xml-parser/pull/791cnnvd
- https://github.com/NaturalIntelligence/fast-xml-parser/releasesPatchcnnvd
- https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-fj3w-jwp8-x2g3cnnvd
- https://github.com/NaturalIntelligence/fast-xml-parser/commit/c13a961910f14986295dd28484eee830fa1a0e8aenisa_euvd
- https://github.com/NaturalIntelligence/fast-xml-parser/pull/791enisa_euvd
- https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-fj3w-jwp8-x2g3enisa_euvd
- https://github.com/NaturalIntelligence/fast-xml-parser/commit/c13a961910f14986295dd28484eee830fa1a0e8aPatchnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan