CVE-2026-27942: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27942 is a stack overflow vulnerability in the fast-xml-parser npm library that causes application crashes (Denial of Service) when the XML builder is used with the preserveOrder:true option and receives non-array input values. It affects fast-xml-parser versions >= 4.0.0-beta.0 and < 4.5.4, and >= 5.0.0 and < 5.3.8. The vulnerability was published on February 25–26, 2026, and patched in versions 4.5.4 and 5.3.8. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 2.7 (Low) (Github Advisory, Red Hat Bugzilla).

The root cause lies in the arrToStr function within src/xmlbuilder/orderedJs2Xml.js, which assumed its input (tagObj[tagName]) was always an array when preserveOrder:true was set. When a non-array value such as a string (e.g., 'baz') is passed, the function iterates over the string's characters using Object.keys(), which returns index keys like ['0']; accessing str['0'] yields the same character, causing arrToStr to recurse infinitely until a RangeError: Maximum call stack size exceeded is thrown. This is classified under CWE-120 (Buffer Copy without Checking Size of Input). The fix, introduced in commit c13a961, adds an Array.isArray guard at the top of arrToStr to treat non-array values as text content instead of recursing into them (Github Advisory, Fix PR, Fix Commit).

Successful exploitation causes the Node.js application using fast-xml-parser to crash with a stack overflow error, resulting in a Denial of Service (DoS) condition. There is no impact on confidentiality or data integrity — only availability is affected. Any service that accepts user-controlled XML or JS object input and passes it to the XMLBuilder with preserveOrder:true is at risk, including downstream IBM products such as API Connect, Maximo Application Suite, App Connect Enterprise, QRadar Suite, and others (Github Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the time of disclosure (Github Advisory). The vulnerability requires no authentication, no user interaction, and no special privileges — an unauthenticated network attacker can trigger the crash by supplying crafted input to any exposed endpoint that uses the vulnerable builder configuration. The EPSS score is approximately 0.018% (5th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Identify target: Locate a web service or API endpoint that uses fast-xml-parser (versions >= 4.0.0-beta.0 and < 4.5.4, or >= 5.0.0 and < 5.3.8) with XMLBuilder configured with preserveOrder:true.
2. Craft malicious input: Construct a JavaScript object (or equivalent JSON payload) where a tag value is a non-array (e.g., a plain string) nested within an array structure, such as:

[{ "foo": [{ "bar": [{ "@_V": "baz" }] }] }]

3. Submit the payload: Send the crafted input to the target endpoint so it is passed to the XMLBuilder.build() method with preserveOrder:true.
4. Trigger stack overflow: The arrToStr function in orderedJs2Xml.js will recursively call itself on each character of the string value, exhausting the call stack and throwing a RangeError: Maximum call stack size exceeded, crashing the Node.js process.
5. Result: The application becomes unavailable (DoS), requiring a restart to recover (Github Advisory, Fix PR).

• Logs: Node.js application logs showing RangeError: Maximum call stack size exceeded originating from orderedJs2Xml.js or the arrToStr function; repeated application crash/restart events in process manager logs (e.g., PM2, systemd).
• Application Behavior: Sudden service unavailability or unhandled exception crashes in services that process XML or accept XML-related API input.
• Network: Unusual or repeated requests to API endpoints that accept XML or JSON-to-XML conversion input, particularly with nested object structures containing string values where arrays are expected.

Upgrade fast-xml-parser to version 5.3.8 (for the v5.x branch) or 4.5.4 (for the v4.x branch), which include the fix adding an Array.isArray guard in arrToStr (Github Advisory, Fix Commit). As a temporary workaround if patching is not immediately possible, configure the XML builder with preserveOrder:false instead of true, or validate and sanitize all input data before passing it to the builder to ensure tag values are always arrays as expected. IBM has released security bulletins for affected products including API Connect, Maximo Application Suite, App Connect Enterprise, QRadar Suite, and others, and users of those products should apply the respective vendor updates (IBM API Connect, IBM App Connect).

The vulnerability was disclosed by the fast-xml-parser maintainer (amitguptagwl) via a GitHub Security Advisory on February 25, 2026, with a fix adopted from a community-contributed pull request by Angelopvtac (Fix PR). Red Hat tracked the issue via Bugzilla and assessed it as medium severity. Multiple IBM product teams issued security bulletins acknowledging the dependency on the vulnerable library. Community reaction was largely routine, with Dependabot alerts automatically propagating to downstream repositories using the affected package.