CVE-2026-25896: fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
(updated )
A dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered.
References
- github.com/NaturalIntelligence/fast-xml-parser
- github.com/NaturalIntelligence/fast-xml-parser/commit/943ef0eb1b2d3284e72dd74f44a042ee9f07026e
- github.com/NaturalIntelligence/fast-xml-parser/commit/ddcd0acf26ddd682cb0dc15a2bd6aa3b96bb1e69
- github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.5
- github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-m7jm-9gc2-mpf2
- github.com/advisories/GHSA-m7jm-9gc2-mpf2
- nvd.nist.gov/vuln/detail/CVE-2026-25896
Code Behaviors & Features
Detect and mitigate CVE-2026-25896 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →