fast‑xml‑parser can crash when an attacker supplies XML data to the XMLBuilder with the preserveOrder flag enabled. This stack overflow results in a process termination and a denial of service. The vulnerability is classified as CWE‑120 and CWE‑776 and does not grant the attacker code execution or data disclosure. The crash can disrupt any service that relies on the parser to produce XML.

The issue affects versions of NaturalIntelligence’s fast‑xml‑parser prior to 5.3.8. Any installation that uses the XMLBuilder with preserveOrder:true is vulnerable unless the library has been updated.

The CVSS base score is 2.7, indicating low impact, and the EPSS score is below 1 %. The vulnerability is not listed in the CISA KEV catalog. An attacker could trigger the stack overflow by supplying crafted XML input to the application. If the application accepts untrusted input, the attack vector is remote. The exploit requires only the ability to feed XML to the XMLBuilder; it does not require privilege escalation or advanced conditions. The overall risk remains low but the crash can disrupt availability of services that depend on the parser.