CVE-2026-25896: fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C+

This week

CRITICAL 9.3REMOTEUPGRADE

CVE-2026-25896 is a critical-severity flaw (CVSS 9.3) affecting fast-xml-parser. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rend

Why this priority

Critical severity
Public exploit reference
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.3 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.5% (top 56%)
CISA exploited list	No
Weakness	CWE-185, CWE-79
Published	2026-02-20
Last modified	2026-09-10

Publisher (CNA): GitHub, Inc. · Vendor: naturalintelligence

Last updated 2026-09-10 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-02-20 21:19 UTCPublished CVE record published
2026-09-10 13:17 UTCUpdated Record last modified

naturalintelligence fast-xml-parser UPGRADE

Affected: >= 4.1.3 and < 5.3.5

Fixed in: 5.3.5

Safe to downgrade to: a release before 4.1.3

1. Check installed version

apt-cache policy fast-xml-parser || rpm -q fast-xml-parser || fast-xml-parser --version

2. UPGRADE to 5.3.5 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade fast-xml-parser

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade fast-xml-parser

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 4.1.3 (Debian / Ubuntu)

apt-cache madison fast-xml-parser sudo apt install fast-xml-parser=<VERSION_BEFORE_4.1.3> sudo apt-mark hold fast-xml-parser

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list fast-xml-parser sudo dnf downgrade fast-xml-parser-<VERSION_BEFORE_4.1.3> sudo dnf versionlock add fast-xml-parser

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-25896?

fast-xml-parser: upgrade to 5.3.5. Exact commands for each OS are on this page.

Is CVE-2026-25896 being exploited?

CVE-2026-25896 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-25896 affect?

CVE-2026-25896 affects fast-xml-parser. Severity is critical (CVSS 9.3). fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard du

How urgent is CVE-2026-25896?

Priority 54/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action

Related CVEs

CVE-2026-41650 MEDIUM 6.1 UPGRADE fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks
CVE-2026-33349 MEDIUM 5.9 UPGRADE fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks
CVE-2026-33036 HIGH 7.5 UPGRADE fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks
CVE-2026-27942 HIGH 7.5 UPGRADE fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C+

References

← Back to latest CVEs