CVE-2026-25128

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `&#9999999;` or `&#xFFFFFF;`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20 CWE-248

Affected software

Vendor	Product	Versions
NaturalIntelligence	fast-xml-parser	>= 5.0.9, <= 5.3.3

References

Timeline

Published: Jan 30, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-251297.3PsySH is a runtime developer console, interactive debugger, and REPL for PHP. Prior to versions 0.11.23 and 0.12.19, PsySH automatically loa CVE-2026-25136.1A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, whereby an administrator who clicks a malicious link pro CVE-2026-251309.6Cybersecurity AI (CAI) is a framework for AI Security. In versions up to and including 0.5.10, the CAI (Cybersecurity AI) framework contains CVE-2026-251318.8OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Ac CVE-2026-251334.8October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting (XS CVE-2026-251348.8Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceCon CVE-2026-251354.5OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 have an inf CVE-2026-251366.1Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizabl CVE-2026-251379.1The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exp CVE-2026-251385.3Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizabl CVE-2026-251399.1RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other em CVE-2026-25146.1In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring p