CVE-2026-25896 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
An attacker can bypass XML entity encoding via regex injection in DOCTYPE names, leading to Cross-Site Scripting (XSS) when parsed output is rendered.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25896?
CVE-2026-25896 is a critical cross-site scripting vulnerability in NaturalIntelligence fast-xml-parser, published on 20 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.
Which versions are affected by CVE-2026-25896?
4 open source packages ship an affected version, including fast-xml-parser. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fast-xml-parser npm | From 4.1.3 | 4.5.4 |
fast-xml-parser npm | From 4.1.3 | 4.5.4 |
fast-xml-parser npm | From 5.0.0 | 5.3.5 |
fast-xml-parser npm | From 5.0.0 | 5.3.5 |
Products include Naturalintelligence Fast-Xml-Parser.
How do I fix CVE-2026-25896?
Upgrade fast-xml-parser to a fixed version for your release line: 4.5.4 or 5.3.5.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-25896 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25896 exists.
Other vulnerabilities in NaturalIntelligence fast-xml-parser
- CVE-2026-33036 fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
- CVE-2026-26278 fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
- CVE-2026-25128 fast-xml-parser has RangeError DoS Numeric Entities Bug
- CVE-2024-41818 ReDOS at currency parsing fast-xml-parser
- CVE-2023-34104 Regex Injection via Doctype Entities
Sources
Also known as CLEANSTART-2026-GZ45856, CLEANSTART-2026-HR43614, CLSA-2026-1789376231, DEBIAN-CVE-2026-25896, ECHO-88fe-9a88-58df, GHSA-m7jm-9gc2-mpf2 and 16 more.