CVE-2026-26278: NaturalIntelligence fast-xml-parser denial of service via entity expansion

CVE-2026-26278 · Severity: high · CVSS 7.5 · Published 2026-02-19

A vulnerability in the fast-xml-parser library, used for processing XML data in Node.js applications, allows attackers to cause a denial-of-service (DoS) condition. By sending a specially crafted, small XML file, an attacker can force the application to consume excessive processing time, effectively freezing the service and making it unavailable to legitimate users. This affects various enterprise products that rely on this library, including several Red Hat platforms.

Technologies: fast-xml-parser (npm), Red Hat Advanced Cluster Security for Kubernetes, Red Hat Developer Hub, Red Hat Self-service automation portal. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-26278 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-26278 being exploited in the wild.
How severe is CVE-2026-26278?
High severity, with a CVSS score of 7.5, published 19 February 2026.
Which products and versions are affected?
fast-xml-parser (npm) SEMVER:introduced=4.1.3,fixed=4.5.4; Red Hat Advanced Cluster Security for Kubernetes 4.8, 4.9; Red Hat Developer Hub 1.8, 1.9; Red Hat Self-service automation portal 2.
Is there a fix for CVE-2026-26278?
Yes. fast-xml-parser (npm): upgrade to 4.5.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26278 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-26278?
Check whether you run fast-xml-parser (npm), Red Hat Advanced Cluster Security for Kubernetes, Red Hat Developer Hub or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • fast-xml-parser (npm): upgrade to 4.5.4 or later
    npm install fast-xml-parser@4.5.4

Technical details

The vulnerability is a variant of an XML Entity Expansion (CWE-776) attack. While the parser has checks to prevent recursive entity expansion (the 'Billion Laughs' attack), it fails to limit the expansion of large entities that contain raw text and are referenced multiple times. The root cause is in the replaceEntitiesValue() function within OrderedObjParser.js, which performs replacements in a loop without enforcing limits on output size or execution time. An attacker can exploit this remotely without authentication by submitting a crafted XML payload. Patches are available in versions 4.5.4 and 5.3.6, which introduce security options like maxEntitySize and maxExpansionDepth.

Affected products

  • NaturalIntelligence fast-xml-parser >= 4.1.3, < 4.5.4; >= 5.0.0, < 5.3.6
  • Red Hat Red Hat Developer Hub 1.8, 1.9
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.8, 4.9
  • Red Hat Migration Toolkit for Applications 8
  • Red Hat Red Hat Openshift Data Foundation 4
  • Red Hat Red Hat OpenShift GitOps 1
  • Red Hat Red Hat OpenShift Virtualization 4
  • Red Hat Red Hat Satellite 6
  • Red Hat Self-service automation portal 2

Identifiers

  • CVE-2026-26278
  • GHSA-jmr7-xgp7-cmfj

Timeline

  • 2026-02-14: patched: Version 5.3.6 released with security fixes
  • 2026-02-19: advisory: GitHub Security Advisory published
  • 2026-02-19: disclosed: CVE-2026-26278 published to NVD
  • 2026-03-30: patched: Red Hat released security advisory RHSA-2026:6174 for Developer Hub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.