Is CVE-2026-25128 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25128 being exploited in the wild.

How severe is CVE-2026-25128?

Low severity, with a CVSS score of 3.1, published 30 January 2026.

Which products and versions are affected?

fast-xml-parser (npm) SEMVER:introduced=5.0.9,fixed=5.3.4.

Is there a fix for CVE-2026-25128?

Yes. fast-xml-parser (npm): upgrade to 5.3.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25128 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-25128?

Check whether you run fast-xml-parser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25128: fast-xml-parser RangeError DoS in numeric entity handling

CVE-2026-25128 · Severity: low · CVSS 3.1 · Published 2026-01-30

fast-xml-parser is a widely-used JavaScript library for parsing XML documents. The library fails to validate numeric character entity values before processing them, allowing an attacker to send malformed XML that crashes the entire Node.js application. Any service that accepts XML input from users (APIs, file processors, feed parsers) can be disrupted with a single malicious request, requiring manual restart to restore service.

Technologies: fast-xml-parser (npm). Vendors: npm.

Quick answers

Is CVE-2026-25128 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25128 being exploited in the wild.
How severe is CVE-2026-25128?: Low severity, with a CVSS score of 3.1, published 30 January 2026.
Which products and versions are affected?: fast-xml-parser (npm) SEMVER:introduced=5.0.9,fixed=5.3.4.
Is there a fix for CVE-2026-25128?: Yes. fast-xml-parser (npm): upgrade to 5.3.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25128 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-25128?: Check whether you run fast-xml-parser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fast-xml-parser (npm): upgrade to 5.3.4 or later
```
npm install fast-xml-parser@5.3.4
```

Technical details

The vulnerability is a missing input validation and exception handling issue (CWE-20, CWE-248) in the entity replacement logic. The regex patterns in OrderedObjParser.js lines 44–45 match numeric entities with values up to 9,999,999 (decimal) or 0xFFFFFF (hex), but the valid Unicode range is only 0–0x10FFFF (1,114,111). When String.fromCodePoint() is called with an out-of-range value, it throws a RangeError. The entity replacement function replaceEntitiesValue() at line 452 lacks a try-catch block, allowing the exception to propagate uncaught. The attack requires network reachability and no authentication; a single POST request with malicious XML triggers the crash. The vulnerability affects versions 5.0.9 through 5.3.3 and is fixed in version 5.3.4.

Affected products

NaturalIntelligence fast-xml-parser 5.0.9 through 5.3.3

Identifiers

CVE-2026-25128
GHSA-37qj-frw5-hhjh

Timeline

2026-01-30: disclosed: Advisory GHSA-37qj-frw5-hhjh published
2026-01-30: patched: Fix released in version 5.3.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.