CVE-2026-126066

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData() in OrderedObjParser.js calls readTagExp() for each less-than character in an unterminated stop-node body and repeatedly rescans the remaining input while looking for a closing greater-than character. An attacker who supplies XML containing many tag fragments without a later closing character can cause quadratic rescanning before parsing fails, blocking a Node.js event loop and causing CPU-exhaustion denial of service. This issue is fixed in version 5.12.0.

• CWE-407

• https://github.com/NaturalIntelligence/fast-xml-parser/commit/0c3659348364959da62954b73728fb3bd05ebcb4
• https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.12.0
• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-474x-hrwr-fgx4

Published

Nov 10, 2026

Last Modified

Nov 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12606Eclipse Grizzly in versions before 5.0.2, cannot properly pa…5.3
• CVE-2026-126061Winter CMS is a content management system built on the Larav…4.3
• CVE-2026-126062Nokogiri is an open source XML and HTML library for the Ruby…3.7
• CVE-2026-126063Nokogiri is an open source XML and HTML library for the Ruby…2.3
• CVE-2026-126064Nokogiri is an open source XML and HTML library for the Ruby…2
• CVE-2026-126065OpenObserve is a cloud-native observability platform. Prior …9.8
• CVE-2026-126067Action Pack is a framework for handling and responding to we…3.1
• CVE-2026-126068Action Mailbox routes incoming emails to controller-like mai…3.7
• CVE-2026-126069Action View is a framework for handling view template lookup…4.7
• CVE-2026-126070Action View is a framework for handling view template lookup…6.1
• CVE-2026-126071Active Storage makes it simple to upload and reference files…5.3
• CVE-2026-126072Action Pack is a framework for handling and responding to we…5.9