Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
NaturalIntelligence fast-xml-parser — fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U N N H 7.5 .0084 55.1 —
AFFECTED
Product Versions Fixed
fast-xml-parser >= 5.0.0, < 5.3.6 – —
TIMELINE
Feb 12 Reserved by GitHub_M
Feb 19 Published (CNA: GitHub_M)
Aug 18 EXPLOIT PUBLISHED — CVE-2026-26278 (NaturalIntelligence fast-xml-parser). Public exploit reference added.
Description
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| February 12, 2026 | Reserved | Reserved by GitHub_M |
| February 19, 2026 | Published | Published (CNA: GitHub_M) |
| August 18, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-26278 (NaturalIntelligence fast-xml-parser). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| NaturalIntelligence | fast-xml-parser | — | >= 5.0.0, < 5.3.6 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-26278 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.