CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2026-25128
High (7.5) in naturalintelligence fast-xml-parser. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in fast-xml-parser 5.3.4.
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `�` or `�`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-20, CWE-248
- Published
- Modified
- Record from
- the NVD, synced
Affected
- naturalintelligence:fast-xml-parser
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-37qj-frw5-hhjh | npm | fast-xml-parser | >=5.0.9 <5.3.4 | 5.3.4 |