--- id: CVE-2026-25896 title: >- fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback summary: >- fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard… severity: critical cvss: 9.3 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N' cwe: - CWE-185 - CWE-79 vendor: naturalintelligence product: fast-xml-parser affected: - 'fast-xml-parser >= 4.1.3, < 5.3.5' patched: - fast-xml-parser 5.3.5 published: '2026-02-20' updated: '2026-09-10' sourceUpdated: '2026-09-10T13:17:54.697' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-25896' references: - url: >- https://github.com/NaturalIntelligence/fast-xml-parser/commit/943ef0eb1b2d3284e72dd74f44a042ee9f07026e label: security-advisories@github.com - url: >- https://github.com/NaturalIntelligence/fast-xml-parser/commit/ddcd0acf26ddd682cb0dc15a2bd6aa3b96bb1e69 label: security-advisories@github.com - url: 'https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.5' label: security-advisories@github.com - url: >- https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-m7jm-9gc2-mpf2 label: security-advisories@github.com - url: 'https://access.redhat.com/errata/RHSA-2026:40984' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:41941' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:41944' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:51349' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:6174' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:6802' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7110' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7128' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-25896' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2441501' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25896.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-25896' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-25896' tags: - nvd - cve.org - exploit-available - csaf - vex - red-hat - score-dispute exploitAvailable: true ssvc: exploitation: poc automatable: 'yes' technicalImpact: partial timestamp: '2026-02-23T19:26:46.154155Z' epss: 0.00498 epssPercentile: 0.40093 scores: nvd: 9.3 vendor: 7.1 cna: 9.3 ingestedAt: '2026-07-16T12:53:55.852Z' --- ## Overview fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5. ## Affected - `fast-xml-parser >= 4.1.3, < 5.3.5` ## Remediation Upgrade past the affected range: - `fast-xml-parser 5.3.5` ## Vendor advisories - **RHSA-2026:7110** · Red Hat · fixed in: Red Hat Advanced Cluster Security 4.8 · released 2026-04-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:7110) - **RHSA-2026:7128** · Red Hat · fixed in: Red Hat Advanced Cluster Security 4.9 · released 2026-04-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:7128) - **RHSA-2026:6174** · Red Hat · fixed in: Red Hat Developer Hub 1.8 · released 2026-03-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:6174) - **RHSA-2026:6802** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-04-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:6802) - **RHSA-2026:41941** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.18 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41941) - **RHSA-2026:41944** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.19 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41944) - **RHSA-2026:40984** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.2 · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:40984) - **RHSA-2026:51349** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51349) - **Red Hat VEX** · Important · affected: Migration Toolkit for Applications 8, Red Hat OpenShift GitOps, Red Hat OpenShift Virtualization 4, Self-service automation portal 2 · no fix planned: Red Hat OpenShift GitOps, Migration Toolkit for Applications 8, Red Hat OpenShift Virtualization 4, Self-service automation portal 2 · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25896.json)