Niedrig 3.7Linux-Server
CVE-2026-126066
fast-xml-parser: fast-xml-parser: Denial of Service via quadratic rescanning of unterminated tags
fast-xml-parser
### Summary With the non-default stopNodes option, a stop node's body with many " " anywhere after makes readStopNodeData() rescan the entire remaining input from every " ` exists - `OrderedObjParser.js:812-818` — on failure, `i` isn't advanced, so the next ` ` lookahead is neither cached nor bounded — `n` copies of ` ` means `n` scans over the remaining input, O(n²) work, before it finally throws. **Fix** 1. Throw immediately in `readStopNodeData()` when `readTagExp()`…
10. Nov 2026
Original bei Red Hat öffnen