fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without
    C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do
    an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser
    spend seconds or even minutes processing a single request, effectively freezing the application. Version
    5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.
    (CVE-2026-26278)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without     C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do     an unlimited amount of entity expansion. With a very small XML input, it's possible to make the parser     spend seconds or even minutes processing a single request, effectively freezing the application. Version     5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.
    (CVE-2026-26278)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
455335	Echo: fast-xml-parser: security update to 4.5.4	Tenable Cloud Security	Echo Local Security Checks	Local	high
455335	Echo: fast-xml-parser: security update to 4.5.4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
299641	Linux Distros Unpatched Vulnerability : CVE-2026-26278	Nessus	Misc.	Local	high
437759	SCA: security update for fast-xml-parser (GHSA-jmr7-xgp7-cmfj)	Tenable Cloud Security	SCA Checks	Local	high
437759	SCA: security update for fast-xml-parser (GHSA-jmr7-xgp7-cmfj)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-26278

high

Tenable Plugins

high

high

high

high

high