LiveActive security incident?Get immediate response
CVE Record

CVE-2026-25896: fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.

CriticalCVSS 9.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

CVE-2026-25896 affects fast-xml-parser, a JavaScript XML parser. Malicious XML can abuse entity handling so characters that should remain safely encoded may become attacker-controlled text. If an application renders parsed output into a web page, this can become cross-site scripting.

Executive priority

Treat this as urgent for internet-facing or partner-facing services that parse XML and display results. Prioritize dependency updates and exposure review because the CVSS score is 9.3 and the vulnerable behavior can directly create XSS.

Technical view

In affected fast-xml-parser versions, a dot in a DOCTYPE entity name is treated as a regex wildcard during entity replacement. This can shadow built-in XML entities such as lt, gt, amp, quot, and apos, bypassing expected encoding. Affected ranges are >=4.1.3,<4.5.4 and >=5.0.0,<5.3.5.

Likely exposure

Exposure is most likely in Node.js or JavaScript applications that parse XML from users, partners, feeds, uploads, or integrations and then render parsed values into HTML or browser-visible content.

Exploitation context

The source bundle reports no KEV listing and provides no evidence of active exploitation. The risk remains high because exploitation is network-reachable, needs no privileges, and can lead to XSS when unsafe parsed output is rendered.

Researcher notes

The root issue is regex injection through entity names during replacement. Validate only in controlled tests, focusing on whether built-in entity behavior can be shadowed and whether downstream rendering creates executable HTML. Do not assume exposure without a rendering path.

Mitigation direction

  • Upgrade fast-xml-parser to version 5.3.5 or later where feasible.
  • For v4 deployments, verify vendor guidance for a non-affected 4.x version.
  • Inventory direct and transitive fast-xml-parser dependencies in all JavaScript projects.
  • Sanitize or encode parsed XML output before rendering it in HTML.
  • Restrict or reject untrusted XML containing DOCTYPE where business logic permits.

Validation and detection

  • Check package manifests and lockfiles for affected fast-xml-parser versions.
  • Confirm deployed artifacts do not contain versions >=4.1.3,<4.5.4 or >=5.0.0,<5.3.5.
  • Identify routes, workers, jobs, or services that parse external XML.
  • Review rendering paths that place parsed XML values into web pages.
  • Run regression tests covering XML entity handling and output encoding.
Prepared
Confidence
high
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-185: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · medium confidence lookup

CWE-79: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-25896 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
5Timeline events
2ADP providers
12Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: yesTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.3CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N3.94.7GitHub_M
7.1CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L2.83.7redhat-SADP

Vulnerability scoring details

Base CVSS 3.1 score

9.3Critical
CVSS 3.1 vector shape for CVE-2026-25896Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. ADP timelineredhat-SADP

    Made public.

  3. CVE publishedCVE Program

    The CVE record was published.

  4. ADP timelineredhat-SADP

    Reported to Red Hat.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
redhat-SADPfast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling
other:Red Hat severity ratingcvssV3_1
  • 2026-02-20T22:01:59.622Z: Reported to Red Hat.
  • 2026-02-20T20:57:48.074Z: Made public.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
NaturalIntelligencefast-xml-parser>= 5.0.0, < 5.3.5, >= 4.1.3, < 4.5.4Listed
Weakness

CWE details

CWE-185CWE-79

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-185 · source CWE mapping

Incorrect Regular Expression

Incorrect Regular Expression represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs
CWE-79 · source CWE mapping

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs