CVE-2026-27942: fast-xml-parser Stack Overflow Vulnerability with preserveOrder
Summary
CVE-2026-27942: fast-xml-parser has stack overflow in XMLBuilder with preserveOrder. Affects fast-xml-parser versions < 5.3.8. Fixed in 5.3.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fast-xml-parser is a popular XML parsing library for Node.js that allows developers to convert XML data into JavaScript objects and vice versa. It is widely used due to its lightweight nature and ease of use. However, a vulnerability has been discovered in its XMLBuilder functionality when the preserveOrder option is enabled, which can lead to application crashes.
Vulnerability Detail
The vulnerability arises from the XMLBuilder's arrToStr function, which fails to validate whether the input is an array or a string. When the preserveOrder option is set to true, certain malformed inputs can cause a stack overflow, leading to application crashes. This issue can be triggered by specific input structures, such as nested arrays or objects, which the function does not handle correctly. The impact of this vulnerability is significant as it can disrupt application functionality and lead to denial of service.
How To Fix
Latest published version: 5.11.2 as of 23 Oct 2026
npm install fast-xml-parser@5.11.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.3.8
This is the first release that contains the fix.
npm install fast-xml-parser@5.3.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can set the preserveOrder option to false when using the XML builder. Alternatively, validate the input data before passing it to the builder to ensure it meets the expected structure. Example code to set preserveOrder to false:
const parser = require('fast-xml-parser');
const options = {
preserveOrder: false
};
const jsonObj = parser.parse(xmlData, options);
Conclusion
The fast-xml-parser package has a vulnerability that can lead to stack overflow and application crashes when using the XMLBuilder with the preserveOrder option enabled. It is crucial to update to the patched version or implement workarounds to ensure application stability.
See every vulnerability recorded for fast-xml-parser →
FAQ
The CVSS score of this vulnerability is 2.7, indicating a low severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
If left unaddressed, this vulnerability can lead to application crashes and potential denial of service, impacting user experience.
Yes, the vulnerability can be triggered by specific input structures, such as nested arrays or objects when using the XMLBuilder with preserveOrder set to true.
It is recommended to upgrade to version 5.3.8 or later of the fast-xml-parser package to mitigate this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for fast-xml-parser.
