fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
Summary
| CVE | CVE-2026-25896 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-02-20 21:19:27 UTC |
| Updated | 2026-07-21 12:17:45 UTC |
| Description | fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5. |
Risk And Classification
Primary CVSS: v3.1 7.1 HIGH from ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS: 0.004450000 probability, percentile 0.361210000 (date 2026-07-21)
Problem Types: CWE-185 | CWE-79 | CWE-185 CWE-185: Incorrect Regular Expression | CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | CVSS | 7.1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
| 3.1 | [email protected] | Secondary | 9.3 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 7.1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
| 3.1 | CNA | DECLARED | 9.3 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
ChangedConfidentiality
LowIntegrity
LowAvailability
LowCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Naturalintelligence | Fast-xml-parser | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | NaturalIntelligence | Fast-xml-parser | affected >= 5.0.0, < 5.3.5 | Not specified |
| CNA | NaturalIntelligence | Fast-xml-parser | affected >= 4.1.3, < 4.5.4 | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4.8 | unaffected 1775594119 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4.9 | unaffected 1775594284 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.8 | unaffected 1774545605 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.9 | unaffected 1775140647 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783676191 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783929816 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1784094353 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1784093953 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1784094943 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783676585 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783676649 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783676675 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1784094299 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1784094725 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783676820 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783676883 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783676894 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1784095175 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783676977 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1784093503 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783677297 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783677345 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1783677533 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783684360 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783684068 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1784054582 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1784054606 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1784055295 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783684603 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783684668 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783684667 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1784054873 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783684707 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1784055589 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783684779 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783684831 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783684839 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1784055533 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1784055558 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1784056134 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783685128 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783685129 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1783685375 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667125 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783666755 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784054598 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055387 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055726 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667517 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667577 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667611 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055020 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667641 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055586 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667790 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667859 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667875 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667869 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667877 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055576 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055244 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055382 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783668266 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783668288 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783669219 * rpm | Not specified |
| ADP | Red Hat | Migration Toolkit For Applications 8 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift GitOps | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift GitOps | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Virtualization 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Virtualization 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Satellite 6 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Satellite 6 | Not specified | Not specified |
| ADP | Red Hat | Self-service Automation Portal 2 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-... | [email protected] | github.com | Exploit, Mitigation, Vendor Advisory |
| github.com/NaturalIntelligence/fast-xml-parser/commit/943ef0eb1b2d3284e7... | [email protected] | github.com | Patch |
| github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.5 | [email protected] | github.com | Product, Release Notes |
| security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25896.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| github.com/NaturalIntelligence/fast-xml-parser/commit/ddcd0acf26ddd682cb... | [email protected] | github.com | Patch |
| access.redhat.com/errata/RHSA-2026:6802 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-25896 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:6174 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:40984 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:7110 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:7128 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:41944 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:41941 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2026-02-20T22:01:59.622Z | Reported to Red Hat. |
| ADP | 2026-02-20T20:57:48.074Z | Made public. |
Solutions
ADP: RHSA-2026:7110: Red Hat Advanced Cluster Security 4.8
ADP: RHSA-2026:7128: Red Hat Advanced Cluster Security 4.9
ADP: RHSA-2026:6174: Red Hat Developer Hub 1.8
ADP: RHSA-2026:6802: Red Hat Developer Hub 1.9
ADP: RHSA-2026:41941: Red Hat Openshift Data Foundation 4.18
ADP: RHSA-2026:41944: Red Hat Openshift Data Foundation 4.19
ADP: RHSA-2026:40984: Red Hat Openshift Data Foundation 4.2
Workarounds
ADP: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
There are currently no legacy QID mappings associated with this CVE.