Read the docs
TI-2026-20935 Aliases CVE-2026-25896GHSA-m7jm-9gc2-mpf2

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

Priority HIGH 79CWE-185Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · High · None
Fix status
Partial Red Hat: 8 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00527 44th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial fast-xml-parser (NaturalIntelligence): 5.3.5, 4.5.4fast-xml-parser (npm): 5.3.5, 4.5.4Red Hat: 8 advisoriesRed Hat: 8 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NaturalIntelligencefast-xml-parser5.0.0 to before 5.3.5; 4.1.3 to before 4.5.45.3.5, 4.5.4Patch availableCNA
—fast-xml-parser (npm)5.0.0 to before 5.3.55.3.5Patch availableGHSA-m7jm-9gc2-mpf2
—fast-xml-parser (npm)4.1.3 to before 4.5.44.5.4Patch availableGHSA-m7jm-9gc2-mpf2
  • fast-xml-parser VendorNaturalIntelligence Affected 5.0.0 to before 5.3.5; 4.1.3 to before 4.5.4 Fixed in 5.3.5, 4.5.4 Patch available CNA
  • fast-xml-parser (npm) Vendor— Affected 5.0.0 to before 5.3.5 Fixed in 5.3.5 Patch available GHSA-m7jm-9gc2-mpf2
  • fast-xml-parser (npm) Vendor— Affected 4.1.3 to before 4.5.4 Fixed in 4.5.4 Patch available GHSA-m7jm-9gc2-mpf2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*4.1.3 to before 5.3.5VulnerableNaturalIntelligence
  • cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:* Versions 4.1.3 to before 5.3.5 Vulnerable ·NaturalIntelligence

Remediation

  • Fix · CNA fast-xml-parser (NaturalIntelligence) Fixed in 5.3.5, 4.5.4
  • Fix · GHSA-m7jm-9gc2-mpf2 fast-xml-parser (npm) Fixed in 5.3.5 Advisory →
  • Fix · GHSA-m7jm-9gc2-mpf2 fast-xml-parser (npm) Fixed in 4.5.4 Advisory →

Red Hat 8 advisories

  • RHSA-2026:51349 Released 2026-08-06 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:41944 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.20 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:41941 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.25 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
Show 5 more Red Hat advisories
  • RHSA-2026:40984 Released 2026-07-16 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20.15 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2026:7128 Released 2026-04-08 · Red Hat rating Important
    RHACS 4.9.5 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
  • RHSA-2026:7110 Released 2026-04-08 · Red Hat rating Important
    RHACS 4.8.10 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
  • RHSA-2026:6802 Released 2026-04-07 · Red Hat rating Important
    Red Hat Developer Hub 1.9.3 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:6174 Released 2026-03-30 · Red Hat rating Important
    Red Hat Developer Hub 1.8.5 release.
    • Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for Applications 8AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Self-service automation portal 2AffectedNo fix yet
Red Hat Advanced Cluster Security 4.8Fixed RHSA-2026:7110
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:7128
Red Hat Developer Hub 1.8Fixed RHSA-2026:6174
Red Hat Developer Hub 1.9Fixed RHSA-2026:6802
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2026:41941
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:41944
Red Hat Openshift Data Foundation 4.20Fixed RHSA-2026:40984
Red Hat Satellite 6.18Fixed RHSA-2026:51349
Not affected: 8 products
  • Red Hat Advanced Cluster Security 4.8
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Developer Hub 1.8
  • Red Hat Developer Hub 1.9
  • Red Hat Openshift Data Foundation 4.18
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Openshift Data Foundation 4.20
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25896
  2. 2026-10-03 Alias added: GHSA-m7jm-9gc2-mpf2

References

Exploit 1

Patch 2

Advisory 1

Other 2

  • TI-2026-25482 fast-xml-parser affected by numeric entity expansion bypassing all entity expansion… CVSS 3.1HIGH 7.5
  • TI-2026-20291 fast-xml-parser has RangeError DoS Numeric Entities Bug CVSS 3.1HIGH 7.5
  • TI-2026-30169 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters CVSS 3.1MEDIUM 6.1
  • TI-2026-25755 fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation CVSS 3.1MEDIUM 5.9
  • TI-2026-21247 fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) CVSS 3.1HIGH 7.5
  • TI-2024-27861 ReDOS at currency parsing fast-xml-parser CVSS 3.1HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences