Read the docs
TI-2026-20291 Aliases CVE-2026-25128GHSA-37qj-frw5-hhjh

fast-xml-parser has RangeError DoS Numeric Entities Bug

Priority HIGH 72CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 6 fixed, 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-248.

Summary

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `�` or `�`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00612 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial fast-xml-parser (npm): 5.3.4Red Hat: 6 advisoriesRed Hat: 6 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NaturalIntelligencefast-xml-parser5.0.9 – 5.3.3—No fix listedCNA
—fast-xml-parser (npm)5.0.9 to before 5.3.45.3.4Patch availableGHSA-37qj-frw5-hhjh
  • fast-xml-parser VendorNaturalIntelligence Affected 5.0.9 – 5.3.3 Fixed in — No fix listed CNA
  • fast-xml-parser (npm) Vendor— Affected 5.0.9 to before 5.3.4 Fixed in 5.3.4 Patch available GHSA-37qj-frw5-hhjh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*5.0.9 to before 5.3.4VulnerableNaturalIntelligence
  • cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:* Versions 5.0.9 to before 5.3.4 Vulnerable ·NaturalIntelligence

Remediation

  • Fix · GHSA-37qj-frw5-hhjh fast-xml-parser (npm) Fixed in 5.3.4 Advisory →

Red Hat 6 advisories

  • RHSA-2026:51349 Released 2026-08-06 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:41944 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.20 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:40984 Released 2026-07-16 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20.15 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
Show 3 more Red Hat advisories
  • RHSA-2026:26420 Released 2026-06-16 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.24 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:7128 Released 2026-04-08 · Red Hat rating Important
    RHACS 4.9.5 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
  • RHSA-2026:7110 Released 2026-04-08 · Red Hat rating Important
    RHACS 4.8.10 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for Applications 8AffectedNo fix yet
Red Hat Advanced Cluster Security 4AffectedNo fix planned: Will not fix
Red Hat Developer Hub 1AffectedNo fix planned: Will not fix
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Self-service automation portal 2AffectedNo fix yet
Red Hat Advanced Cluster Security 4.8Fixed RHSA-2026:7110
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:7128
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2026:26420
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:41944
Red Hat Openshift Data Foundation 4.20Fixed RHSA-2026:40984
Red Hat Satellite 6.18Fixed RHSA-2026:51349
Not affected: 7 products
  • Red Hat Advanced Cluster Security 4.8
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat OpenShift GitOps
  • Red Hat Openshift Data Foundation 4.18
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Openshift Data Foundation 4.20
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25128
  2. 2026-10-03 Alias added: GHSA-37qj-frw5-hhjh
  3. 2026-10-27 Affected versions changed · Red Hat

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-20935 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names CVSS 3.1CRITICAL 9.3
  • TI-2026-25482 fast-xml-parser affected by numeric entity expansion bypassing all entity expansion… CVSS 3.1HIGH 7.5
  • TI-2026-30169 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters CVSS 3.1MEDIUM 6.1
  • TI-2026-25755 fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation CVSS 3.1MEDIUM 5.9
  • TI-2026-21247 fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) CVSS 3.1HIGH 7.5
  • TI-2024-27861 ReDOS at currency parsing fast-xml-parser CVSS 3.1HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences