{"affected":[{"product":"fast-xml-parser","source":"CNA: GitHub_M","vendor":"NaturalIntelligence","versions":[{"status":"affected","version":"< 5.12.0"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"fast-xml-parser","product":"fast-xml-parser","source":"OSV GHSA-474x-hrwr-fgx4","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"5.12.0"}],"lessThan":"5.12.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-126066","cwes":["CWE-407"],"description":"fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData() in OrderedObjParser.js calls readTagExp() for each less-than character in an unterminated stop-node body and repeatedly rescans the remaining input while looking for a closing greater-than character. An attacker who supplies XML containing many tag fragments without a later closing character can cause quadratic rescanning before parsing fails, blocking a Node.js event loop and causing CPU-exhaustion denial of service. This issue is fixed in version 5.12.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":3.7,"severity":"low","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}],"modifiedAt":1794345303074,"publishedAt":1794342196019,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-474x-hrwr-fgx4"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/NaturalIntelligence/fast-xml-parser/commit/0c3659348364959da62954b73728fb3bd05ebcb4"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.12.0"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-474x-hrwr-fgx4"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-474x-hrwr-fgx4"}],"remediation":[{"kind":"fix","source":"OSV GHSA-474x-hrwr-fgx4","text":"fast-xml-parser (npm): OSV reports a fixed version 5.12.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-474x-hrwr-fgx4"}],"revision":"c83274e385475c08d27180c4004bfa423578669f2302e2e3433b423c3601435e","sources":[{"modifiedAt":1794342196019,"name":"CNA: GitHub_M","retrievedAt":1794346832362,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126066"},{"modifiedAt":1794345303074,"name":"OSV / GitHub Security Advisories","retrievedAt":1794346833280,"url":"https://osv.dev/vulnerability/GHSA-474x-hrwr-fgx4"}],"ssvc":null,"status":"published","title":"fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags","updatedAt":1794346833280}