LowGHSA-fj3w-jwp8-x2g3CVE-2026-27942

fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

Published 26 Feb 2026 · Updated 10 Sept 2026

Affected packages

fast-xml-parsernpm
Affected
>=5.0.0 <5.3.8
Fixed in
5.3.8
Update to the fixed version for your release line, for example:npm install fast-xml-parser@5.3.8
fast-xml-parsernpm
Affected
>=4.0.0-beta.0 <4.5.4
Fixed in
4.5.4
Update to the fixed version for your release line, for example:npm install fast-xml-parser@4.5.4

Details

Impact

Application crashes with stack overflow when user use XML builder with prserveOrder:true for following or similar input

[{
    'foo': [
        { 'bar': [{ '@_V': 'baz' }] }
    ]
}]

Cause: arrToStr was not validating if the input is an array or a string and treating all non-array values as text content. _What kind of vulnerability is it? Who is impacted?_

Patches

Yes in 5.3.8

Workarounds

Use XML builder with preserveOrder:false or check the input data before passing to builder.

References

_Are there any links users can visit to find out more?_

Is GHSA-fj3w-jwp8-x2g3 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected fast-xml-parser, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.