fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData() in OrderedObjParser.js calls readTagExp() for each less-than character in an unterminated stop-node body and repeatedly rescans the remaining input while looking for a closing greater-than character. An attacker who supplies XML containing many tag fragments without a later closing character can cause quadratic rescanning before parsing fails, blocking a Node.js event loop and causing CPU-exhaustion denial of service. This issue is fixed in version 5.12.0.

Affected: npm: fast-xml-parser

### Summary

With the non-default stopNodes option, a stop node's body with many "<a " fragments and no closing ">" anywhere after makes readStopNodeData() rescan the entire remaining input from every "<". The failed lookahead is neither cached nor bounded, so n fragments cost O(n²) before the parser throws. Availability-only (CPU exhaustion), needs the non-default stopNodes option — not benchmarked yet, see Proof of Concept.

### Details

**CWE-407** — Inefficient Algorithmic Complexity

**Code** - `OrderedObjParser.js:520` — `parseXml()` calls `readStopNodeData()` after a matching stop node opens - `OrderedObjParser.js:810` — calls `readTagExp()` for every non-special `<` - `OrderedObjParser.js:688-722` — `tagExpWithClosingIndex()` scans to end-of-input and returns `undefined` when no `>` exists - `OrderedObjParser.js:812-818` — on failure, `i` isn't advanced, so the next `<` repeats the same full scan - `OrderedObjParser.js:423` — the main parse loop throws immediately on the same failure; only the stop-node path retries

**Root cause:** a failed closing-`>` lookahead is neither cached nor bounded — `n` copies of `<a ` with no later `>` means `n` scans over the remaining input, O(n²) work, before it finally throws.

**Fix** 1. Throw immediately in `readStopNodeData()` when `readTagExp()` returns `undefined` 2. Or break the loop on the first failed scan 3. Or find the next `>` once and reuse/bound that result 4. Add a test asserting near-linear scaling when payload size do…