CVE-2026-26278: 
JavaScript vulnerability analysis and mitigation

CVE-2026-26278 is an XML entity expansion denial-of-service vulnerability in the fast-xml-parser npm library, classified as CWE-776 (Improper Restriction of Recursive Entity References in DTDs). It affects versions 4.1.3 through 4.5.3 and 5.0.0 through 5.3.5, and was disclosed on February 14, 2026 by the library maintainer via a GitHub Security Advisory. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause lies in the replaceEntitiesValue() function within OrderedObjParser.js, which repeatedly calls val.replace() in a loop with no limits on total output size or execution cost (CWE-776). While DocTypeReader.js contains a check that rejects entities referencing other entities (blocking classic "Billion Laughs" payloads by detecting & in entity values), it does not prevent a simpler variant: defining one large entity containing only raw text and referencing it many times. An unauthenticated remote attacker can craft a small XML document with a DOCTYPE declaration defining a large text entity and referencing it repeatedly, causing the parser to expand it without bound. Because Node.js is single-threaded, this blocks the event loop entirely, preventing the server from handling any other requests (GitHub Advisory, Patch Commit).

Successful exploitation results in complete denial of service for any Node.js application that parses user-supplied XML using fast-xml-parser with its default configuration. A payload of only a few kilobytes can render an HTTP server entirely unresponsive for several minutes, with all concurrent requests timing out. There is no confidentiality or integrity impact — the vulnerability is limited to availability — but the ease of triggering it with minimal input makes it a significant operational risk for externally-facing services (GitHub Advisory, Red Hat Bugzilla).

A public proof-of-concept (PoC) is included in the GitHub Security Advisory itself, demonstrating that a ~1.3 KB XML payload causes 4–8 seconds of parser hang, and larger payloads can hang the process indefinitely. No authentication or user interaction is required, and the attack complexity is low. As of the time of disclosure, there is no evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.049% (low probability of near-term exploitation) (GitHub Advisory, Feedly).

1. Identify target: Locate a service that accepts user-supplied XML and uses fast-xml-parser versions 4.1.3–4.5.3 or 5.0.0–5.3.5 with default configuration (i.e., processEntities not set to false).
2. Craft the payload: Construct a small XML document with a DOCTYPE block defining a large text entity (e.g., 1,000–50,000 characters of raw text) and referencing it many times in the document body:

<!DOCTYPE foo [<!ENTITY big "AAAA...A">]><root>&big;&big;&big;...&big;</root>

3. Send the request: Submit the crafted XML to the target endpoint via HTTP POST or any other supported input channel. No credentials or special headers are required.
4. Observe DoS: The parser's replaceEntitiesValue() loop begins expanding the entity without limit, blocking the Node.js event loop. The server becomes unresponsive to all other requests for the duration of the expansion (seconds to minutes depending on payload size).
5. Repeat for sustained DoS: Send repeated requests to keep the server continuously unresponsive (GitHub Advisory).

• Network: Incoming HTTP requests with XML bodies containing <!DOCTYPE declarations and large entity definitions; unusually small request payloads (1–50 KB) associated with prolonged server unresponsiveness.
• Logs: Application or web server logs showing requests that never complete or time out; Node.js process logs indicating event loop lag or high CPU usage correlated with XML parsing endpoints.
• Process: Node.js process consuming 100% CPU for extended periods (seconds to minutes) without completing a request; absence of normal request throughput during the high-CPU period.
• Application Behavior: HTTP 503 or timeout errors returned to legitimate clients during periods when a small XML request is being processed (GitHub Advisory).

Upgrade fast-xml-parser to version 4.5.4 or 5.3.6 (or later), which introduce configurable limits on entity expansion via new options: maxEntitySize (default 10,000 chars), maxTotalExpansions (default 1,000), maxExpandedLength (default 100,000 chars), and maxExpansionDepth (default 10). If immediate patching is not possible, set processEntities: false in the parser options to disable DOCTYPE entity processing entirely as a workaround. IBM has issued advisories for multiple affected products (API Connect, Instana, Maximo Application Suite, watsonx Orchestrate, Guardium Data Security Center, QRadar Suite, and others) and users of those products should apply the relevant IBM security bulletins (GitHub Release, Patch Commit, Red Hat Bugzilla).

The vulnerability received coverage from SecurityOnline.info, which highlighted the high severity and the library's wide reach (~46 million downloads). Red Hat tracked the issue via Bugzilla and issued errata (RHSA-2026:6174, RHSA-2026:6802). IBM issued security bulletins for over a dozen affected enterprise products. Social media activity was modest, with posts on Bluesky from The Hacker Wire and brief community discussion on Mastodon (SecurityOnline, Red Hat Bugzilla).