Skip to content
Fencer Vulns
high 7.5

CVE-2026-25128 json

fast-xml-parser has RangeError DoS Numeric Entities Bug

published 2026-01-30 9 mo ago modified 2026-09-10 1 mo ago also EUVD-2026-5026 , GHSA-37qj-frw5-hhjh

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits
0
none known

Summary

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `�` or `�`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue.

Patch / fix

  • npm fast-xml-parser 5.3.4
  • naturalintelligence fast_xml_parser 5.3.4
  • fast-xml-parser_project fast-xml-parser 5.3.4
  • velociraptor openSUSE Tumbleweed 0.7.0.4.git185.a5708584-2.1

opensuse advisories openSUSE-SU-2026:11126-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-25128 updated cvss 5.3

fast-xml-parser: fast-xml-parser has RangeError DoS Numeric Entities Bug

  • Red Hat Migration Toolkit for Applications 8 mta/mta-ui-rhel9
    affected: workaround, no fix available
  • Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-scanner-v4-rhel8, advanced-cluster-security/rhacs-scanner-v4-db-rhel8 Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal
    affected: workaround, no fix available
  • Red Hat Advanced Cluster Security 4.8 advanced-cluster-security 1775594119
    fixed: vendor fix RHSA-2026:7110
  • Red Hat Advanced Cluster Security 4.9 advanced-cluster-security 1775594284
    fixed: vendor fix RHSA-2026:7128
  • Red Hat Openshift Data Foundation 4.18 odf4/cephcsi-rhel9 1781555717, odf4/odf-cli-rhel9 1781557189, odf4/mcg-core-rhel9 1781555645, odf4/odf-console-rhel9 1781556534, odf4/mcg-rhel9-operator 1781556009, odf4/ocs-rhel9-operator 1781555679, +13 more
    fixed: vendor fix RHSA-2026:26420
  • Red Hat Openshift Data Foundation 4.19 odf4/cephcsi-rhel9 1783684360, odf4/odf-cli-rhel9 1784054873, odf4/mcg-core-rhel9 1784054582, odf4/odf-console-rhel9 1784055589, odf4/mcg-rhel9-operator 1784054606, odf4/ocs-rhel9-operator 1783684667, +14 more
    fixed: vendor fix RHSA-2026:41944
  • Red Hat Openshift Data Foundation 4.20 odf4/cephcsi-rhel9 1783667125, odf4/odf-cli-rhel9 1784055020, odf4/mcg-core-rhel9 1784054598, odf4/odf-console-rhel9 1784055586, odf4/mcg-rhel9-operator 1784055387, odf4/ocs-rhel9-operator 1783667611, +16 more
    fixed: vendor fix RHSA-2026:40984
show 3 more
  • Red Hat Satellite 6.18 satellite/iop-host-inventory-frontend-rhel9 1785922764
    fixed: vendor fix RHSA-2026:51349
  • Red Hat Advanced Cluster Security 4.8 advanced-cluster-security 1774163438, advanced-cluster-security 1774294180, advanced-cluster-security 1775594119 Red Hat Advanced Cluster Security 4.9 advanced-cluster-security 1774260292, advanced-cluster-security 1774294136, advanced-cluster-security 1775594284 Red Hat Openshift Data Foundation 4.18 odf4/mcg-operator-bundle 1781560103, odf4/ocs-operator-bundle 1781560412, odf4/odf-operator-bundle 1781561286, odf4/cephcsi-operator-bundle 1781560319, odf4/odr-hub-operator-bundle 1781561780, odf4/rook-ceph-operator-bundle 1781560380, +7 more Red Hat Openshift Data Foundation 4.19 odf4/mcg-operator-bundle 1784058120, odf4/ocs-operator-bundle 1784058383, odf4/odf-operator-bundle 1784058758, odf4/cephcsi-operator-bundle 1784057956, odf4/odr-hub-operator-bundle 1784058873, odf4/rook-ceph-operator-bundle 1784059042, +7 more Red Hat Openshift Data Foundation 4.20 odf4/mcg-operator-bundle 1784058849, odf4/ocs-operator-bundle 1784059112, odf4/odf-operator-bundle 1784060452, odf4/cephcsi-operator-bundle 1784058684, odf4/odr-hub-operator-bundle 1784060213, odf4/rook-ceph-operator-bundle 1784059800, +8 more Red Hat OpenShift GitOps openshift-gitops-1/gitops-operator-bundle
    not affected: vulnerable code not present
  • Red Hat Satellite 6 satellite/iop-vulnerability-frontend-rhel9
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
9 mo ago

Exploit prediction

0.61% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-37qj-frw5-hhjh referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm fast-xml-parser
>=5.0.9, <5.3.4
5.3.4

Affected products

  • NaturalIntelligence fast-xml-parser

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.