CVE-2026-25128: fast-xml-parser DoS Vulnerability

CVE-2026-25128 Overview

CVE-2026-25128 is a Denial of Service vulnerability affecting fast-xml-parser, a popular JavaScript library that enables users to validate XML, parse XML to JavaScript objects, or build XML from JavaScript objects without C/C++ based libraries. A RangeError vulnerability exists in the numeric entity processing functionality when parsing XML containing out-of-range entity code points (e.g., � or �). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input.

Critical Impact

Applications processing untrusted XML input are vulnerable to complete denial of service through crafted XML payloads containing out-of-range numeric entities. Attackers can remotely crash affected services without authentication.

Affected Products

• fast-xml-parser versions 4.3.6 through 5.3.3
• Node.js applications using vulnerable fast-xml-parser versions
• Web services and APIs that parse untrusted XML using fast-xml-parser

Discovery Timeline

• 2026-01-30 - CVE-2026-25128 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2026-25128

Vulnerability Analysis

This vulnerability is classified under CWE-20 (Improper Input Validation). The flaw exists in how fast-xml-parser handles numeric character references (HTML entities) during XML parsing. When the parser encounters numeric entities with code point values that exceed the valid Unicode range (0x0 to 0x10FFFF), the String.fromCodePoint() method throws a RangeError exception. Since this exception is not caught by the parser, it propagates up the call stack and crashes the entire Node.js application.

The vulnerability affects both decimal (&#decimal;) and hexadecimal (&#xhex;) numeric entity formats. An attacker can exploit this by submitting XML containing specially crafted numeric entities such as � (decimal) or � (hexadecimal), both of which exceed the maximum valid Unicode code point.

Root Cause

The root cause lies in the OrderedObjParser.js module where numeric entities are processed. The vulnerable code directly calls String.fromCodePoint() on parsed numeric values without first validating that the values fall within the acceptable Unicode code point range (0 to 1,114,111 or 0x10FFFF). The String.fromCodePoint() function throws a RangeError for invalid code points, and this exception was not being handled, resulting in application termination.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can send malicious XML payloads to any endpoint that uses fast-xml-parser to process XML input. This makes web APIs, SOAP services, and any XML-processing microservices particularly vulnerable. The attack complexity is low as it only requires crafting an XML document with an out-of-range numeric entity.

// Vulnerable code in src/xmlparser/OrderedObjParser.js (before patch)
       "copyright" : { regex: /&(copy|#169);/g, val: "©" },
       "reg" : { regex: /&(reg|#174);/g, val: "®" },
       "inr" : { regex: /&(inr|#8377);/g, val: "₹" },
-      "num_dec": { regex: /&#([0-9]{1,7});/g, val : (_, str) => String.fromCodePoint(Number.parseInt(str, 10)) },
-      "num_hex": { regex: /&#x([0-9a-fA-F]{1,6});/g, val : (_, str) => String.fromCodePoint(Number.parseInt(str, 16)) },
+      "num_dec": { regex: /&#([0-9]{1,7});/g, val : (_, str) => fromCodePoint(str, 10, "&#") },
+      "num_hex": { regex: /&#x([0-9a-fA-F]{1,6});/g, val : (_, str) => fromCodePoint(str, 16, "&#x") },
     };
     this.addExternalEntities = addExternalEntities;
     this.parseXml = parseXml;

Source: GitHub Commit Update

Detection Methods for CVE-2026-25128

Indicators of Compromise

• Unexpected application crashes or service restarts in Node.js applications processing XML
• Error logs containing RangeError: Invalid code point exceptions originating from fast-xml-parser
• Incoming XML payloads containing numeric entities with unusually large values (e.g., �, �)
• Increased rate of HTTP 500 errors on XML-processing endpoints

Detection Strategies

• Monitor application logs for uncaught RangeError exceptions with stack traces pointing to fast-xml-parser modules
• Implement Web Application Firewall (WAF) rules to detect XML payloads containing numeric entities with more than 6 hexadecimal or 7 decimal digits
• Use dependency scanning tools to identify applications using fast-xml-parser versions 4.3.6 through 5.3.3
• Deploy application performance monitoring (APM) to detect sudden process terminations in XML-processing services

Monitoring Recommendations

• Enable process crash monitoring for all Node.js services that handle XML input
• Set up alerts for repeated service restarts within short time windows
• Monitor for patterns of malformed XML requests targeting API endpoints
• Review and audit all dependencies using npm audit or similar tools regularly

How to Mitigate CVE-2026-25128

Immediate Actions Required

• Upgrade fast-xml-parser to version 5.3.4 or later immediately
• Audit all Node.js applications to identify usage of vulnerable fast-xml-parser versions
• Implement input validation on XML payloads before passing them to the parser
• Deploy WAF rules to block XML payloads with suspicious numeric entity patterns

Patch Information

The vulnerability has been fixed in fast-xml-parser version 5.3.4. The patch introduces a new fromCodePoint() helper function that validates numeric entity values before calling String.fromCodePoint(), gracefully handling out-of-range values instead of throwing uncaught exceptions. The fix is available via the GitHub Release v5.3.4. Additional details can be found in the GitHub Security Advisory GHSA-37qj-frw5-hhjh.

Workarounds

• Wrap fast-xml-parser calls in try-catch blocks to prevent application crashes from propagating
• Implement pre-processing validation to reject XML containing numeric entities with values exceeding 0x10FFFF
• Use process managers like PM2 with automatic restart capabilities to minimize service disruption
• Consider rate limiting on XML-processing endpoints to reduce the impact of exploitation attempts

# Update fast-xml-parser to patched version
npm update fast-xml-parser@5.3.4

# Verify installed version
npm list fast-xml-parser

# Run security audit to check for remaining vulnerabilities
npm audit