---
id: "CVE-2026-126066"
page: "https://infrastack.ai/live/CVE-2026-126066"
kind: "vulnerability"
aliases: ["CVE-2026-126066", "GHSA-474x-hrwr-fgx4"]
title: "fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "fast-xml-parser", "fixed": ["5.12.0"], "affected": "<= 5.11.2", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-407", "fast-xml-parser", "node.js", "package", "xml-parsing"]
not_affected_if: ["default-config", "trusted-input"]
published_at: "2026-11-10T21:09:44+00:00"
first_seen_at: "2026-11-10T21:12:45+00:00"
updated_at: "2026-11-10T21:14:29+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-474x-hrwr-fgx4", "first_seen_at": "2026-11-10T21:12:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126066", "first_seen_at": "2026-11-10T21:46:15+00:00"}]
exploit_sources: []
---

# fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags

Link for people: https://infrastack.ai/live/CVE-2026-126066 (this .md is for agents)

fast-xml-parser versions up to 5.11.2 take quadratic time to parse a stop-node body containing many unterminated "<a " fragments when the non-default stopNodes option is set. An attacker who can send XML to such a parser can stall the event loop and exhaust CPU, causing denial of service with no data exposure.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:fast-xml-parser affected <= 5.11.2 fixed 5.12.0

## How to check

- Check the installed version with `npm ls fast-xml-parser`; affected versions are `5.11.2` and earlier.
- Search the code for `stopNodes` in calls to the parser; the bug only applies when that option is set.
- Check whether that parser handles XML from untrusted sources.

## Fix

- `fast-xml-parser` `5.12.0`

## Timeline

- 2026-11-10T21:12:45+00:00 ghsa https://github.com/advisories/GHSA-474x-hrwr-fgx4
- 2026-11-10T21:46:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126066

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/NaturalIntelligence/fast-xml-parser/security-advisories/GHSA-474x-hrwr-fgx4
- [advisory] Maintainer's advisory: github.com https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-474x-hrwr-fgx4
- [fix] Patch: github.com https://github.com/NaturalIntelligence/fast-xml-parser/commit/0c3659348364959da62954b73728fb3bd05ebcb4
- [fix] Release: github.com https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.12.0

## From the sources

### Summary

With the non-default stopNodes option, a stop node's body with many "<a " fragments and no closing ">" anywhere after makes readStopNodeData() rescan the entire remaining input from every "<". The failed lookahead is neither cached nor bounded, so n fragments cost O(n²) before the parser throws. Availability-only (CPU exhaustion), needs the non-default stopNodes option — not benchmarked yet, see Proof of Concept.

### Details

**CWE-407** — Inefficient Algorithmic Complexity

**Code**
- `OrderedObjParser.js:520` — `parseXml()` calls `readStopNodeData()` after a matching stop node opens
- `OrderedObjParser.js:810` — calls `readTagExp()` for every non-special `<`
- `OrderedObjParser.js:688-722` — `tagExpWithClosingIndex()` scans to end-of-input and returns `undefined` when no `>` exists
- `OrderedObjParser.js:812-818` — on failure, `i` isn't advanced, so the next `<` repeats the same full scan
- `OrderedObjParser.js:423` — the main parse loop throws immediately on the same failure; only the stop-node path retries

**Root cause:** a failed closing-`>` lookahead is neither cached nor bounded — `n` copies of `<a ` with no later `>` means `n` scans over the remaining input, O(n²) work, before it finally throws.

**Fix**
1. Throw immediately in `readStopNodeData()` when `readTagExp()` returns `undefined`
2. Or break the loop on the first failed scan
3. Or find the next `>` once and reuse/bound that result
4. Add a test asserting near-linear scaling when payload size doubles

### Proof of concept

Not benchmarked — static-analysis finding, confidence 0.5.

To confirm: configure `stopNodes` matching a root element. Build input as `'<stop>' + '<a '.repeat(n)`. Time `parse()` until it throws `Unexpected end of <tag>`. Start around n=10,000 and double it — quadratic should show ~4x time per doubling, linear ~2x. Control: same input with a `>` present, or `stopNodes` unset.

### Impact

CPU-exhaustion DoS in Node.js services parsing untrusted XML with `stopNodes` enabled. A ~100KB payload is estimated at ~10⁹ character operations (roughly a second or more of blocked event loop) — analytical estimate, not a benchmark. No confidentiality/integrity impact. CVSS 3.1: `AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L` (3.7, Low).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_