CVE-2026-25896: naturalintelligence fast-xml-parser Incorrect Regular Expression
Vulnerability summary
CVE-2026-25896 is a critical (CVSS 9.3) Incorrect Regular Expression vulnerability in naturalintelligence fast-xml-parser. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 20-02-2026PublishedVulnerability first disclosed.
- 10-09-2026Last modifiedVulnerability information updated.
Description
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:LDiffers
- OSV · DebianEcosystem advisory · calculated9.3CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated9.3CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
- OSV · NpmEcosystem advisory · calculated9.3CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated9.3CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
- NVDNIST9.3CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
EPSS trend
Probability
0.57%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
+0.11 pp
From 0.46% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundFast Xml Parser
Maturity: poc
Weaknesses
CWE · root cause- CWE-185Incorrect Regular ExpressionThe product specifies a regular expression in a way that causes data to be improperly matched or compared.
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected systems
Chainguard15 products
- dbgate< 7.0.6-r1
- dbgate-fips< 7.1.0-r0
- kibana-8.18All versions (No fix recorded)
- kibana-8.18-bitnamiAll versions (No fix recorded)
- kibana-8.18-iamguardedAll versions (No fix recorded)
Wolfi4 products
- prism< 5.14.3-r7
- renovate< 43.48.3-r0
- saf< 1.6.0-r0
- tileserver-gl< 5.5.0-r5
Debian1 product
- node-webfontAll versions (No fix recorded)
Naturalintelligence1 product
- fast-xml-parser≥ 5.0.0, < 5.3.5 | ≥ 4.1.3, < 4.5.4 | ≥ 4.1.3, < 5.3.5
Npm1 product
- fast-xml-parser≥ 5.0.0, < 5.3.5 | ≥ 4.1.3, < 4.5.4
Ubuntu1 product
- node-webfontAll versions (No fix recorded)
6 vendors · 23 products
References
21 links- github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-m7jm-9gc2-mpf2X Refsource CONFIRMREPORTAdvisoryWEBExploitMitigationVendor Advisory
- github.com/NaturalIntelligence/fast-xml-parser/commit/943ef0eb1b2d3284e72dd74f44a042ee9f07026eX Refsource MISCREPORTFIXWEBPatch
- github.com/NaturalIntelligence/fast-xml-parser/commit/ddcd0acf26ddd682cb0dc15a2bd6aa3b96bb1e69X Refsource MISCREPORTFIXWEBPatch
- github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.5X Refsource MISCREPORTWEBProductRelease Notes
