CVE-2026-25896 — Incorrect Regular Expression

Vendor	Product	Version range	Fixed in
debian	node-webfont	—	—
naturalintelligence	fast-xml-parser	—	—
naturalintelligence	fast-xml-parser	—	—
naturalintelligence	fast-xml-parser	>= 0 < 5.7.0	5.7.0
naturalintelligence	fast-xml-parser	>= 4.1.3 < 5.3.5	5.3.5
naturalintelligence	fast-xml-parser	>= 4.1.3 < 4.5.4	4.5.4
naturalintelligence	fast-xml-parser	>= 5.0.0 < 5.3.5	5.3.5

Red Hat

fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling

vendor_redhat·2026-02-20·CVSS 9.3

CVE-2026-25896 [CRITICAL] CWE-79 fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities ( , &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5. A flaw was found in fast-xml-parser. A remote attacker can exploit this vulnerability by providing a specially crafted XML input. The system incorrectly interprets a dot in a DOCTYPE entity name as a regular expression wildcar

Debian

CVE-2026-25896: node-webfont - fast-xml-parser allows users to validate XML, parse XML to JS object, or build X...

vendor_debian·2026·CVSS 9.3

CVE-2026-25896 [CRITICAL] CVE-2026-25896: node-webfont - fast-xml-parser allows users to validate XML, parse XML to JS object, or build X... fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities ( , &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5. Scope: local bookworm: undetermined forky: undetermined sid: undetermined trixie: undetermined

GHSA

fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

ghsa·2026-04-22·CVSS 6.5

CVE-2026-41650 [MEDIUM] CWE-91 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters # fast-xml-parser XMLBuilder: Comment and CDATA Injection via Unescaped Delimiters ## Summary fast-xml-parser XMLBuilder does not escape the `-->` sequence in comment content or the `]]>` sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. Existing CVEs for fast-xml-parser cover different issues: - CVE-2023-26920: Prototype pollution (parser) - CVE-2023-34104: ReDoS (parser) - CVE-2026-27942: Stack overflow in XMLBuilder with preserveOrder - CVE-2026-25896: Entity encoding bypass via regex in DOCTYPE entities This finding covers **unescaped

GHSA

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

ghsa·2026-02-20·CVSS 7.5

CVE-2026-25896 [HIGH] CWE-185 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names # Entity encoding bypass via regex injection in DOCTYPE entity names ## Summary A dot (`.`) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (` `, `&`, `"`, `'`) with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. ## Details The fix for CVE-2023-34104 addressed some regex metacharacters in entity names but missed `.` (period), which is valid in XML names per the W3C spec. In `DocTypeReader.js`, entity names are passed directly to `RegExp()`: ```js entities[entityName] = { regx: RegExp(`&${entityName};`, "g"), val: val }; ``` An entity named `l.` produces the

OSV

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

osv·2026-02-20·CVSS 7.5

CVE-2026-25896 [HIGH] fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names # Entity encoding bypass via regex injection in DOCTYPE entity names ## Summary A dot (`.`) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (` `, `&`, `"`, `'`) with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. ## Details The fix for CVE-2023-34104 addressed some regex metacharacters in entity names but missed `.` (period), which is valid in XML names per the W3C spec. In `DocTypeReader.js`, entity names are passed directly to `RegExp()`: ```js entities[entityName] = { regx: RegExp(`&${entityName};`, "g"), val: val }; ``` An entity named `l.` produces the

OSV

CVE-2026-25896: fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback

osv·2026-02-20·CVSS 9.3

CVE-2026-25896 [CRITICAL] CVE-2026-25896: fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities ( , &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.

CVE-2026-25896: fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to…

Affected

CVSS provenance