CVE-2026-25896

Critical · CVSS 9.3

fast-xml-parser — DOCTYPE entity name regex wildcard XSS (CWE-185, CWE-79)

CVSS: 9.3; nvd
EPSS: 0.46%; 38th pct
KEV: No
Class: oss containerizable; CWE-185, CWE-79

Description

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.

Search profile — drives PoC discovery

Symbols DOCTYPEentity replacementregex wildcarddot (.) wildcard<>&"'fast-xml-parserXMLParserNaturalIntelligenceGHSA-m7jm-9gc2-mpf2943ef0eb1b2d3284e72dd74f44a042ee9f07026eddcd0acf26ddd682cb0dc15a2bd6aa3b96bb1e69

Keywords CVE-2026-25896fast-xml-parserDOCTYPE entity XSSentity shadow bypassregex wildcard entityXML entity encoding bypassGHSA-m7jm-9gc2-mpf2fast-xml-parser XSS PoCfast-xml-parser exploitNaturalIntelligence fast-xml-parser vulnerability

Versions: >=4.1.3, <5.3.5

Affected packages

npm	fast-xml-parser	4.1.3 → 4.5.4
npm	fast-xml-parser	5.0.0 → 5.3.5

References

Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-07-01T00:30:14.000Z