Main Vulnerability Database Vulnerabilities #VU123126

NULL pointer dereference in fast-xml-parser - CVE-2026-26278

Published: February 23, 2026

Vulnerability identifier: #VU123126

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-26278

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the replaceEntitiesValue() function in OrderedObjParser.js. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Affected software

fast-xml-parser
Cognos Analytics Mobile (iOS)
Cognos Analytics Mobile (Android)
Guardium Data Security Center (GDSC)
Maximo Application Suite Ai Service
IBM App Connect Enterprise
OpenShift Data Foundation (formerly OpenShift Container Storage)

How to mitigate CVE-2026-26278

Install updates from vendor's website.

fast-xml-parser - update to 5.3.6
Cognos Analytics Mobile (iOS) - update to 1.1.26
Cognos Analytics Mobile (Android) - update to 1.1.26
Guardium Data Security Center (GDSC) - update to 3.8.8
Maximo Application Suite Ai Service - update to 9.1.13
IBM App Connect Enterprise - addressed in versions 12.0.12.24, 13.0.6.2
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.18.25, 4.19.20

Links to Public Exploits and PoC-codes

Exploit #12433 - DoS through entity expansion in DOCTYPE (no expansion limit) (February 23, 2026)

External References

https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jmr7-xgp7-cmfj