CVE-2026-126066

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-126066", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-11-10T17:07:43.283Z", "datePublished": "2026-11-10T20:23:16.019Z", "dateUpdated": "2026-11-12T18:01:44.471Z"}, "containers": {"cna": {"title": "fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags", "problemTypes": [{"descriptions": [{"cweId": "CWE-407", "lang": "en", "description": "CWE-407: Inefficient Algorithmic Complexity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-474x-hrwr-fgx4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-474x-hrwr-fgx4"}, {"name": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/0c3659348364959da62954b73728fb3bd05ebcb4", "tags": ["x_refsource_MISC"], "url": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/0c3659348364959da62954b73728fb3bd05ebcb4"}, {"name": "https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.12.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.12.0"}], "affected": [{"vendor": "NaturalIntelligence", "product": "fast-xml-parser", "versions": [{"version": "< 5.12.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-10T20:23:16.019Z"}, "descriptions": [{"lang": "en", "value": "fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData() in OrderedObjParser.js calls readTagExp() for each less-than character in an unterminated stop-node body and repeatedly rescans the remaining input while looking for a closing greater-than character. An attacker who supplies XML containing many tag fragments without a later closing character can cause quadratic rescanning before parsing fails, blocking a Node.js event loop and causing CPU-exhaustion denial of service. This issue is fixed in version 5.12.0."}], "source": {"advisory": "GHSA-474x-hrwr-fgx4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T16:26:25.008210Z", "id": "CVE-2026-126066", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-12T18:01:44.471Z"}}]}}

{}

{"affected": [{"affectedData": [{"product": "fast-xml-parser", "vendor": "NaturalIntelligence", "versions": [{"status": "affected", "version": "< 5.12.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData() in OrderedObjParser.js calls readTagExp() for each less-than character in an unterminated stop-node body and repeatedly rescans the remaining input while looking for a closing greater-than character. An attacker who supplies XML containing many tag fragments without a later closing character can cause quadratic rescanning before parsing fails, blocking a Node.js event loop and causing CPU-exhaustion denial of service. This issue is fixed in version 5.12.0."}], "id": "CVE-2026-126066", "lastModified": "2026-11-12T18:17:23.860", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-126066", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T16:26:25.008210Z", "version": "2.0.3"}}]}, "published": "2026-11-10T21:19:24.487", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/0c3659348364959da62954b73728fb3bd05ebcb4"}, {"source": "security-advisories@github.com", "url": "https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.12.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-474x-hrwr-fgx4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-407"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "fast-xml-parser: fast-xml-parser: Denial of Service via quadratic rescanning of unterminated tags", "id": "2571224", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571224"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-606", "details": ["A flaw was found in fast-xml-parser. When the stopNodes configuration option is enabled, the parser repeatedly rescans remaining input when encountering unterminated tag fragments. A remote attacker could exploit this vulnerability by supplying specially crafted XML input containing numerous unclosed tags, consuming excessive CPU resources and causing a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-126066", "package_state": [{"cpe": "cpe:/a:redhat:cryostat:4", "fix_state": "Fix deferred", "package_name": "cryostat/cryostat-openshift-console-plugin-rhel9", "product_name": "Cryostat 4"}, {"cpe": "cpe:/a:redhat:migration_toolkit_applications:8", "fix_state": "Fix deferred", "package_name": "mta/mta-ui-rhel9", "product_name": "Migration Toolkit for Applications 8"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Fix deferred", "package_name": "openshift-serverless-1/logic-rhel9-operator", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:advanced_cluster_security:4", "fix_state": "Fix deferred", "package_name": "advanced-cluster-security/rhacs-main-rhel8", "product_name": "Red Hat Advanced Cluster Security 4"}, {"cpe": "cpe:/a:redhat:advanced_cluster_security:4", "fix_state": "Fix deferred", "package_name": "advanced-cluster-security/rhacs-main-rhel9", "product_name": "Red Hat Advanced Cluster Security 4"}, {"cpe": "cpe:/a:redhat:advanced_cluster_security:5", "fix_state": "Fix deferred", "package_name": "advanced-cluster-security/rhacs-main-rhel9", "product_name": "Red Hat Advanced Cluster Security 5"}, {"cpe": "cpe:/a:redhat:connectivity_link:1", "fix_state": "Fix deferred", "package_name": "rhcl-1/rhcl-rhdh-dynamic-plugin-rhel9", "product_name": "Red Hat Connectivity Link 1"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend", "product_name": "Red Hat Developer Hub 1"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-orchestrator", "product_name": "Red Hat Developer Hub 1"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend", "product_name": "Red Hat Developer Hub 1"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator", "product_name": "Red Hat Developer Hub 1"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub 1"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-community-plugin-catalog-backend-module-keycloak", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-community-plugin-rbac", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-community-plugin-scaffolder-backend-module-regex", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-community-plugin-tech-radar", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-community-plugin-tech-radar-backend", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-community-plugin-topology", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-plugin-catalog-backend-module-github", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-plugin-catalog-backend-module-github-org", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-plugin-catalog-backend-module-gitlab", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-plugin-catalog-backend-module-gitlab-org", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-plugin-kubernetes", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-plugin-kubernetes-backend", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-plugin-org", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-plugin-scaffolder-backend-module-github", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-plugin-techdocs", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-plugin-techdocs-backend", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-plugin-techdocs-module-addons-contrib", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-app-defaults", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-app-integrations", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-bulk-import", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-bulk-import-backend", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-global-header", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-homepage", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-homepage-backend", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-intelligent-assistant", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-intelligent-assistant-backend", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-orchestrator", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-quickstart", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/rhdh-hub-rhel10", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Fix deferred", "package_name": "odf4/mcg-core-rhel9", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Fix deferred", "package_name": "odf4/ocs-client-console-rhel9", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Fix deferred", "package_name": "odf4/odf-console-rhel9", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Fix deferred", "package_name": "odf4/odf-multicluster-console-rhel9", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Fix deferred", "package_name": "openshift-gitops-1/argocd-rhel9", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:container_native_virtualization:4", "fix_state": "Out of support scope", "package_name": "container-native-virtualization/kubevirt-console-plugin", "product_name": "Red Hat OpenShift Virtualization 4"}, {"cpe": "cpe:/a:redhat:container_native_virtualization:4", "fix_state": "Out of support scope", "package_name": "container-native-virtualization/kubevirt-console-plugin-rhel9", "product_name": "Red Hat OpenShift Virtualization 4"}, {"cpe": "cpe:/a:redhat:container_native_virtualization:5", "fix_state": "Fix deferred", "package_name": "container-native-virtualization/kubevirt-console-plugin-rhel9", "product_name": "Red Hat OpenShift Virtualization 5"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/automation-portal", "product_name": "Self-service automation portal 2"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/bootc-automation-portal-rhel9", "product_name": "Self-service automation portal 2"}], "public_date": "2026-11-10T20:23:16Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-126066\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-126066\nhttps://github.com/NaturalIntelligence/fast-xml-parser/commit/0c3659348364959da62954b73728fb3bd05ebcb4\nhttps://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.12.0\nhttps://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-474x-hrwr-fgx4"], "statement": "This flaw is rated as a Low severity vulnerability because triggering it requires a specific, non-default configuration in consuming applications and results only in temporary CPU exhaustion without impacting data confidentiality or integrity. Under default parsing configurations across Red Hat environments, the affected stop-node processing routine is inactive, meaning typical workloads are not exposed to the condition. Applications are only susceptible if they explicitly activate stop-node parsing and process unvalidated XML payloads from untrusted sources.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.12.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "fast-xml-parser", "source": "cna", "vendor": "NaturalIntelligence"}, "product": "fast-xml-parser", "vendor": "naturalintelligence"}], "created": "2026-11-12T01:30:05.188076+00:00", "updated": "2026-11-13T11:45:20.063327+00:00", "vendors": ["naturalintelligence", "naturalintelligence$PRODUCT$fast-xml-parser"]}