CVE-2026-25128

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-25128
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `�` or `�`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e387f61c4a5cef792f6a2f42467013290bf95dc Patch
https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.4 Release Notes
https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-37qj-frw5-hhjh Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*
History

17 Jun 2026, 10:24

Type Values Removed Values Added
Summary
  • (es) fast-xml-parser permite a los usuarios validar XML, analizar XML a objeto JS o construir XML desde objeto JS sin librerías basadas en C/C++ y sin callback. En las versiones 4.3.6 a la 5.3.3, existe una vulnerabilidad de tipo RangeError en el procesamiento de entidades numéricas de fast-xml-parser al analizar XML con puntos de código de entidad fuera de rango (p. ej., '?' o '?'). Esto provoca que el analizador lance una excepción no capturada, lo que bloquea cualquier aplicación que procesa entrada XML no confiable. La versión 5.3.4 corrige el problema.

27 Feb 2026, 20:22

Type Values Removed Values Added
References () https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e387f61c4a5cef792f6a2f42467013290bf95dc - () https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e387f61c4a5cef792f6a2f42467013290bf95dc - Patch
References () https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.4 - () https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.4 - Release Notes
References () https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-37qj-frw5-hhjh - () https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-37qj-frw5-hhjh - Exploit, Vendor Advisory
CPE cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*
First Time Naturalintelligence
Naturalintelligence fast-xml-parser

11 Feb 2026, 19:15

Type Values Removed Values Added
Summary (en) fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.3.6 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `�` or `�`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue. (en) fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `�` or `�`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue.

30 Jan 2026, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-30 16:16

Updated : 2026-06-17 10:24

NVD link : CVE-2026-25128

Mitre link : CVE-2026-25128

CVE.ORG link : CVE-2026-25128

JSON object : View

Products Affected

naturalintelligence

  • fast-xml-parser
CWE
CWE-20

Improper Input Validation

CWE-248

Uncaught Exception