fast-xml-parser has stack overflow in XMLBuilder with preserveOrder
Date: 2026-02
Affected: npm/fast-xml-parser, npm/fast-xml-parser
Attack vector: other
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2026-27942
CWE: CWE-120

### Impact Application crashes with stack overflow when user use XML builder with `prserveOrder:true` for following or similar input ``` [{ 'foo': [ { 'bar': [{ '@_V': 'baz' }] } ] }] ``` Cause: `arrToStr` was not validating if the input is an array or a string and treating all non-array values as text content. _What kind of vulnerability is it? Who is impacted?_ ### Patches Yes in 5.3.8 ### Workarounds Use XML builder with `preserveOrder:false` or check the input data before passing to builder. ### References [_Are there any links users can visit to find out more?_](https://github.com/NaturalIntelligence/fast-xml-parser/pull/791)


Mitigations:

Architectural layers (MAESTRO):