Input validation error in fast-xml-parser - CVE-2026-27942

Vulnerability identifier: #VU126614

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-27942

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in arrToStr in XMLBuilder when processing input with preserveOrder enabled. A remote user can supply specially crafted input to cause a denial of service.

Only applications using the XML builder with preserveOrder set to true are vulnerable.

fast-xml-parser
Cognos Analytics Mobile (iOS)
Cognos Analytics Mobile (Android)
IBM App Connect Enterprise
OpenShift Data Foundation (formerly OpenShift Container Storage)

Install security update from vendor's website.

fast-xml-parser - addressed in versions 4.5.4, 5.3.7
Cognos Analytics Mobile (iOS) - update to 1.1.26
Cognos Analytics Mobile (Android) - update to 1.1.26
IBM App Connect Enterprise - addressed in versions 12.0.12.26, 13.0.7.2
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.18.25, 4.19.20

• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-fj3w-jwp8-x2g3
• https://github.com/NaturalIntelligence/fast-xml-parser/pull/791

• Input validation error in fast-xml-parser
• Multiple vulnerabilities in IBM Cognos Analytics Mobile
• Multiple vulnerabilities in IBM App Connect Enterprise
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.18
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.19