Executive brief
fast-xml-parser is a popular JavaScript library for parsing and building XML documents. When the XMLBuilder feature is used with the preserveOrder option enabled, the application can crash due to a stack overflow caused by improper input validation. This causes service unavailability but does not result in data exposure or unauthorized access.
Technical details
The vulnerability is a stack overflow in the arrToStr function of the XMLBuilder component when preserveOrder is set to true. The root cause is insufficient input validation: arrToStr does not properly check whether its input is an array or a string, and incorrectly treats all non-array values as text content, leading to infinite recursion. An attacker can trigger this by crafting malicious XML or JSON input with nested object structures (e.g., {'foo': [{'bar': [{'@_V': 'baz'}]}]}) and passing it to XMLBuilder with preserveOrder enabled. The exploit requires no authentication and is remotely exploitable over the network if the vulnerable library is used in a web service. The vulnerability causes application crashes (denial of service). Patches are available in versions 4.5.4 and 5.3.7 or later; users can also work around the issue by disabling preserveOrder or validating input before passing it to the builder.
Affected products
- NaturalIntelligence fast-xml-parser 4.0.0-beta.0 through 5.3.6 (fixed in 4.5.4 and 5.3.7+)
Timeline
- 2026-02-26: disclosed
- 2026-02-26: patched: Fixed in versions 4.5.4 and 5.3.7+