CVE-2026-25896
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
In fast-xml-parser versions 4.1.3 through before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered.
Risk Assessment
The risk is the injection of malicious JavaScript into applications that render parsed XML, potentially leading to session data theft, account takeover, or website defacement.
Recommendation
Immediately update fast-xml-parser to version 5.3.5 or later, which contains the fix for this vulnerability.
Other vulnerabilities in fast-xml-parser
See all- CVE-2026-73569High
fast-xml-parser versions 5.9.3 through 5.10.1 have a vulnerability related to processing multiple DOCTYPE declarations in a single XML document. The addInputEntities() function resets entity expansion limits on each call, allowing bypass of protections and potentially causing excessive CPU usage, event-loop blocking, memory exhaustion, and process termination. The issue is fixed in version 5.10.1.
- CVE-2026-26278High
A vulnerability in the fast-xml-parser library allows a DoS attack via unlimited entity expansion. Even a small XML file can cause prolonged processing and freeze the application.
- CVE-2023-34104High
fast-xml-parser is an open source, pure JavaScript XML parser that allows special characters in entity names, which are not properly escaped. An attacker can exploit this vulnerability to perform denial of service (DoS) attacks by crafting entity names that generate inefficient regular expressions.
Original NVD description (English source)
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS