Junglewise Threat Intelligence

CVE-2026-26278: NaturalIntelligence fast-xml-parser denial of service via entity expansion

CVE-2026-26278 · Severity: high · CVSS 7.5 · Published 2026-02-19

Executive brief

A vulnerability in the fast-xml-parser library, used for processing XML data in Node.js applications, allows attackers to cause a denial-of-service (DoS) condition. By sending a specially crafted, small XML file, an attacker can force the application to consume excessive processing time, effectively freezing the service and making it unavailable to legitimate users. This affects various enterprise products that rely on this library, including several Red Hat platforms.

Technical details

The vulnerability is a variant of an XML Entity Expansion (CWE-776) attack. While the parser has checks to prevent recursive entity expansion (the 'Billion Laughs' attack), it fails to limit the expansion of large entities that contain raw text and are referenced multiple times. The root cause is in the replaceEntitiesValue() function within OrderedObjParser.js, which performs replacements in a loop without enforcing limits on output size or execution time. An attacker can exploit this remotely without authentication by submitting a crafted XML payload. Patches are available in versions 4.5.4 and 5.3.6, which introduce security options like maxEntitySize and maxExpansionDepth.

Affected products

  • NaturalIntelligence fast-xml-parser >= 4.1.3, < 4.5.4; >= 5.0.0, < 5.3.6
  • Red Hat Red Hat Developer Hub 1.8, 1.9
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.8, 4.9
  • Red Hat Migration Toolkit for Applications 8
  • Red Hat Red Hat Openshift Data Foundation 4
  • Red Hat Red Hat OpenShift GitOps 1
  • Red Hat Red Hat OpenShift Virtualization 4
  • Red Hat Red Hat Satellite 6
  • Red Hat Self-service automation portal 2

Timeline

  • 2026-02-14: patched: Version 5.3.6 released with security fixes
  • 2026-02-19: advisory: GitHub Security Advisory published
  • 2026-02-19: disclosed: CVE-2026-26278 published to NVD
  • 2026-03-30: patched: Red Hat released security advisory RHSA-2026:6174 for Developer Hub

References

Related threats