# CVE-2025-25341: libxmljs segmentation fault in entity node parsing

Source: https://junglewise.ai/threats/cve-2025-25341-libxmljs-segmentation-fault-in-entity-node-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-25341 · Severity: high · CVSS 7.5 · Published 2025-12-26

libxmljs is a Node.js library used to parse and manipulate XML documents. A vulnerability allows attackers to crash applications that use this library by triggering a segmentation fault when parsing specially crafted XML files containing entity declarations. This denial-of-service attack requires only a malicious XML file and results in complete service unavailability.

Technologies: [libxmljs (npm)](https://junglewise.ai/threats/technologies/libxmljs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-25341 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-25341 being exploited in the wild.

**How severe is CVE-2025-25341?** High severity, with a CVSS score of 7.5, published 26 December 2025.

**Which products and versions are affected?** libxmljs (npm) SEMVER:introduced=0,last_affected=1.0.11.

**Is there a fix for CVE-2025-25341?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-25341 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-25341?** Check whether you run Libxmljs Project Libxmljs or libxmljs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a segmentation fault (CWE-400: Uncontrolled Resource Consumption) in libxmljs version 1.0.11 that occurs when accessing the internal _ref property on entity_ref and entity_decl nodes after parsing a specially crafted XML document. The root cause stems from improper handling of XML entity references—when an attacker provides an XML file with entity declarations and the application accesses the _ref property directly (either via property access, console.log, or Object.getOwnPropertyNames), the library dereferences an invalid pointer, causing the process to crash. The attack requires only network/file access to provide a malicious XML document (no authentication or user interaction needed) and affects all versions up to and including 1.0.11. The impact is denial of service through application crash; potential for further memory corruption and data leakage has been noted but not demonstrated.

## Affected products

- libxmljs libxmljs up to and including 1.0.11

## Identifiers

- CVE-2025-25341
- GHSA-jv72-59wq-8rxm

## Timeline

- 2025-01-09: disclosed: Issue reported on GitHub
- 2025-12-26: advisory: Security advisory published

## References

- [https://github.com/libxmljs/libxmljs/issues/667](https://github.com/libxmljs/libxmljs/issues/667)

## Related threats

- [libxmljs type confusion in attrs() on entity nodes](https://junglewise.ai/threats/cve-2024-34391-libxmljs-type-confusion-in-attrs-on-entity-nodes)
- [libxmljs type confusion in namespaces parsing](https://junglewise.ai/threats/cve-2024-34392-libxmljs-type-confusion-in-namespaces-parsing)
- [libxmljs denial of service in parseXml](https://junglewise.ai/threats/cve-2022-21144-libxmljs-denial-of-service-in-parsexml)