Bug 2571224 (CVE-2026-126066)

Summary: CVE-2026-126066 fast-xml-parser: fast-xml-parser: Denial of Service via quadratic rescanning of unterminated tags
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: aazores, abarbaro, abuckta, alizardo, anjoseph, cmah, dhanak, dkeler, dkuc, drosa, dsimansk, dymurray, eaguilar, ebaron, jchui, jhe, jlanda, jmatsuok, jprabhak, jtolenti, kingland, kshier, ktsao, mnovotny, nboldt, oaljalju, orabin, pjindal, psrna, rbobbitt, sausingh, simaishi, stcannon, suppawar, thason, wtam, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in fast-xml-parser. When the stopNodes configuration option is enabled, the parser repeatedly rescans remaining input when encountering unterminated tag fragments. A remote attacker could exploit this vulnerability by supplying specially crafted XML input containing numerous unclosed tags, consuming excessive CPU resources and causing a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-10 20:56:02 UTC 
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData() in OrderedObjParser.js calls readTagExp() for each less-than character in an unterminated stop-node body and repeatedly rescans the remaining input while looking for a closing greater-than character. An attacker who supplies XML containing many tag fragments without a later closing character can cause quadratic rescanning before parsing fails, blocking a Node.js event loop and causing CPU-exhaustion denial of service. This issue is fixed in version 5.12.0.