CVE Watch10 nov 2026

CVE-2026-126066

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default

CVSS

3.7

Bajo

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 10 nov 2026 · Última mod.: 10 nov 2026 · CWE-407

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData() in OrderedObjParser.js calls readTagExp() for each less-than character in an unterminated stop-node body and repeatedly rescans the remaining input while looking for a closing greater-than character. An attacker who supplies XML containing many tag fragments without a later closing character can cause quadratic rescanning before parsing fails, blocking a Node.js event loop and causing CPU-exhaustion denial of service. This issue is fixed in version 5.12.0.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1240165.3 MED

—

——0postal-mime before 4.2.1 contains an algorithmic complexity denial of service vulnerability that allows unauthenticated remote attackers to cause excessive CPU consumption in the PostalMime.processLine() function by crafting deeply nested multipart email messages with boundary lines sharing long prefixes with open boundaries. Attackers can deliver a malicious email with nesting up to the default maxNestingDepth of 256, causing per-line parsing cost to scale as O(depth x shared prefix length) and blocking the Node.js event loop for seconds per message.9h CVE-2026-1207965.3 MED

—

——0Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.4h CVE-2026-1187497.5 ALT

—

——0Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.10h CVE-2026-1187477.5 ALT

—

——0Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.6h CVE-2026-1181537.5 ALT

—

——0Inefficient algorithmic complexity in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.10h CVE-2026-1129667.5 ALT

—

——0Uncontrolled resource consumption in Windows Security Account Manager allows an unauthorized attacker to deny service over a network.9h