CVE-2026-25128

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `&#9999999;` or `&#xFFFFFF;`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e387f61c4a5cef792f6a2f42467013290bf95dc	Patch
https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.4	Release Notes
https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-37qj-frw5-hhjh	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-01-30 16:16

Updated : 2026-02-27 20:22

NVD link : CVE-2026-25128

Mitre link : CVE-2026-25128

CVE.ORG link : CVE-2026-25128

JSON object : View

Products Affected

naturalintelligence

fast-xml-parser

CWE

CWE-20

Improper Input Validation

CWE-248

Uncaught Exception

{"id": "CVE-2026-25128", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2026-01-30T16:16:14.123", "references": [{"url": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e387f61c4a5cef792f6a2f42467013290bf95dc", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.4", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-37qj-frw5-hhjh", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-248"}]}], "descriptions": [{"lang": "en", "value": "fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `&#9999999;` or `&#xFFFFFF;`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue."}, {"lang": "es", "value": "fast-xml-parser permite a los usuarios validar XML, analizar XML a objeto JS o construir XML desde objeto JS sin librer\u00edas basadas en C/C++ y sin callback. En las versiones 4.3.6 a la 5.3.3, existe una vulnerabilidad de tipo RangeError en el procesamiento de entidades num\u00e9ricas de fast-xml-parser al analizar XML con puntos de c\u00f3digo de entidad fuera de rango (p. ej., '?' o '?'). Esto provoca que el analizador lance una excepci\u00f3n no capturada, lo que bloquea cualquier aplicaci\u00f3n que procesa entrada XML no confiable. La versi\u00f3n 5.3.4 corrige el problema."}], "lastModified": "2026-02-27T20:22:44.700", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98ED3450-6A9F-46D1-9619-2EB783A43FBF", "versionEndExcluding": "5.3.4", "versionStartIncluding": "5.0.9"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}