CVE WatchNov 10, 2026

CVE-2026-126066

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default

CVSS

3.7

Low

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-407

EPSS · 30d

Not enough EPSS history yet.

Technical description

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData() in OrderedObjParser.js calls readTagExp() for each less-than character in an unterminated stop-node body and repeatedly rescans the remaining input while looking for a closing greater-than character. An attacker who supplies XML containing many tag fragments without a later closing character can cause quadratic rescanning before parsing fails, blocking a Node.js event loop and causing CPU-exhaustion denial of service. This issue is fixed in version 5.12.0.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1240165.3 MED

—

——0postal-mime before 4.2.1 contains an algorithmic complexity denial of service vulnerability that allows unauthenticated remote attackers to cause excessive CPU consumption in the PostalMime.processLine() function by crafting deeply nested multipart email messages with boundary lines sharing long prefixes with open boundaries. Attackers can deliver a malicious email with nesting up to the default maxNestingDepth of 256, causing per-line parsing cost to scale as O(depth x shared prefix length) and blocking the Node.js event loop for seconds per message.8h CVE-2026-1207965.3 MED

—

——0Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.3h CVE-2026-1187497.5 HIG

—

——0Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.9h CVE-2026-1187477.5 HIG

—

——0Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.5h CVE-2026-1181537.5 HIG

—

——0Inefficient algorithmic complexity in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.9h CVE-2026-1129667.5 HIG

—

——0Uncontrolled resource consumption in Windows Security Account Manager allows an unauthorized attacker to deny service over a network.8h