CVE-2026-126066: 
JavaScript vulnerability analysis and mitigation

CVE-2026-126066 is a denial-of-service vulnerability in the fast-xml-parser npm package (by NaturalIntelligence) caused by quadratic CPU consumption when scanning unterminated stop-node tags. When the non-default stopNodes option is enabled, the readStopNodeData() function in OrderedObjParser.js calls readTagExp() for every < character encountered in an unterminated stop-node body, repeatedly rescanning the remaining input without caching or bounding the failed lookahead — resulting in O(n²) work before the parser throws. All versions up to and including 5.11.2 are affected; the issue was fixed in version 5.12.0. It carries a CVSS v3.1 base score of 3.7 (Low) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-407 (Inefficient Algorithmic Complexity) and CWE-606 (Unchecked Input for Loop Condition). In OrderedObjParser.js, parseXml() invokes readStopNodeData() when a matching stop node opens (line ~520); inside that function, readTagExp() is called for every non-special < character (line ~810). When tagExpWithClosingIndex() scans to end-of-input and returns undefined because no > exists (lines ~688–722), the loop index i is not advanced, causing the next < to repeat the same full scan from scratch (lines ~812–818). An attacker crafting XML with many < fragments but no closing > inside a stop-node body can trigger n full rescans over the remaining input — O(n²) total character operations — before the parser finally throws. The fix (commit 0c36593) introduces a lenient mode and caches the next > index so that failed lookaheads are bounded and not repeated (Github Advisory, Fix Commit).

Exploitation results in CPU-exhaustion denial of service, blocking the Node.js event loop for the duration of the quadratic rescan. A ~100 KB crafted payload is analytically estimated to produce approximately 10⁹ character operations, potentially stalling the event loop for a second or more and rendering the service unresponsive to legitimate requests. There is no confidentiality or integrity impact; the vulnerability is availability-only and scoped to the affected component (Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported; the advisory notes the finding is a static-analysis result with a confidence of 0.5 and has not been benchmarked. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the non-default stopNodes parser option to be enabled, raising the effective attack complexity (Github Advisory, Feedly).

1. Identify target: Locate a Node.js service that uses fast-xml-parser version ≤ 5.11.2 with the stopNodes option configured to match a root or commonly used element (e.g., stopNodes: ['root']).
2. Craft malicious XML payload: Construct an XML document that opens the matched stop-node element and then includes a large number of < characters (tag fragments) without any corresponding closing > character inside the stop-node body. For example: <root> followed by a string of n repetitions of <fragment (no >).
3. Scale payload for impact: Start with n ≈ 10,000 fragments and double the count to confirm quadratic behavior (~4× processing time per doubling). A ~100 KB payload is estimated to cause approximately 10⁹ character operations.
4. Submit payload: Send the crafted XML to the target service's XML-parsing endpoint via HTTP or any other input channel that feeds data to the parser.
5. Achieve DoS: The parser's readStopNodeData() function rescans the entire remaining input for each < fragment, blocking the Node.js event loop and causing the service to become unresponsive to legitimate requests until the parse attempt completes or times out (Github Advisory).

• Network: Repeated or unusually large XML POST requests to endpoints that accept XML input; payloads containing many < characters without corresponding > closings inside a single element body.
• Logs: Node.js application logs showing high CPU usage or event loop lag spikes correlated with XML parsing operations; timeout errors or unresponsive service alerts following receipt of specific XML payloads.
• Process: Sustained near-100% CPU utilization by the Node.js process without a corresponding increase in request throughput; event loop delay metrics (e.g., from perf_hooks) spiking dramatically during XML parse operations.

Upgrade fast-xml-parser to version 5.12.0 or later, which contains the fix that caches the next > index and introduces a lenient fallback mode to prevent repeated full rescans (v5.12.0 Release, Fix Commit). As a temporary workaround, avoid enabling the stopNodes option when parsing untrusted XML input, or implement input size limits and request timeouts to bound the impact of malformed payloads. Organizations using Red Hat products that bundle this library should monitor the associated Red Hat Bugzilla entry for downstream patch availability (Red Hat Bugzilla).