fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without
    C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow
    when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use
    XML builder with `preserveOrder:false` or check the input data before passing to builder. (CVE-2026-27942)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without     C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow     when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use     XML builder with `preserveOrder:false` or check the input data before passing to builder. (CVE-2026-27942)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
457586	Echo: fast-xml-parser: security update to 4.5.4	Tenable Cloud Security	Echo Local Security Checks	Local	medium
457586	Echo: fast-xml-parser: security update to 4.5.4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
438061	SCA: security update for fast-xml-parser (GHSA-fj3w-jwp8-x2g3)	Tenable Cloud Security	SCA Checks	Local	medium
438061	SCA: security update for fast-xml-parser (GHSA-fj3w-jwp8-x2g3)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
300159	Linux Distros Unpatched Vulnerability : CVE-2026-27942	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-27942

medium

Tenable Plugins

medium

medium

medium

medium

medium