CVE-2026-25896: NaturalIntelligence fast-xml-parser XSS via regex injection in DOCTYPE

CVE-2026-25896 · Severity: critical · CVSS 9.3 · Published 2026-02-20

A vulnerability in the fast-xml-parser library allows attackers to bypass security protections that normally prevent malicious code from being injected into web pages. By sending a specially crafted XML file, an attacker can trick the software into ignoring standard safety filters, potentially leading to unauthorized data access or the execution of malicious scripts in a user's browser. This affects any application using this library to process untrusted data, including several enterprise platforms from Red Hat.

Technologies: fast-xml-parser (npm), Red Hat Advanced Cluster Security for Kubernetes, Red Hat Developer Hub. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-25896 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-25896 being exploited in the wild.
How severe is CVE-2026-25896?
Critical severity, with a CVSS score of 9.3, published 20 February 2026.
Which products and versions are affected?
fast-xml-parser (npm) SEMVER:introduced=5.0.0,fixed=5.3.5; Red Hat Advanced Cluster Security for Kubernetes 4.8, 4.9; Red Hat Developer Hub 1.8, 1.9.
Is there a fix for CVE-2026-25896?
Yes. fast-xml-parser (npm): upgrade to 5.3.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25896 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-25896?
Check whether you run fast-xml-parser (npm), Red Hat Advanced Cluster Security for Kubernetes or Red Hat Developer Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • fast-xml-parser (npm): upgrade to 5.3.5 or later
    npm install fast-xml-parser@5.3.5

Technical details

A regex injection vulnerability exists in fast-xml-parser (v4 and v6 codebases) where a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement. Because DOCTYPE entities are processed before built-in XML entities (like < or &), an attacker can define an entity name such as 'l.' which generates the regex /&l.;/g. This matches and replaces standard entities like < with arbitrary, malicious values. This bypasses the library's entity encoding trust boundary, leading to Cross-Site Scripting (XSS) when the parsed output is rendered in HTML or potential SQL injection if used in database queries. The issue is fixed in version 5.3.5 by properly escaping regex metacharacters.

Affected products

  • NaturalIntelligence fast-xml-parser >= 4.1.3, < 5.3.5
  • Red Hat Red Hat Developer Hub 1.8, 1.9
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.8, 4.9

Identifiers

  • CVE-2026-25896
  • GHSA-m7jm-9gc2-mpf2

Timeline

  • 2026-02-08: patched: Version 5.3.5 released
  • 2026-02-20: disclosed: Security advisory published via GitHub and NVD
  • 2026-03-30: advisory: Red Hat issued security advisory RHSA-2026:6174

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.