7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25128

CVE-2026-25128: fast-xml-parser has RangeError DoS Numeric Entities Bug

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., &#9999999; or &#xFFFFFF;). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25128

CVE-2026-25128:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fast-xml-parser	npm	>= 4.3.6, <= 5.3.3	5.3.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Denial of Service caused by an uncaught RangeError in the fast-xml-parser library. The root cause is the improper handling of numeric XML entities. The analysis of the provided patch (commit 4e387f61c4a5cef792f6a2f42467013290bf95dc) and the vulnerability description confirms this.

In src/xmlparser/OrderedObjParser.js, the configuration for decimal and hexadecimal numeric entities used anonymous arrow functions to perform the conversion. These functions parsed the numeric string and directly called String.fromCodePoint().

The vulnerability description explicitly states that the function replaceEntitiesValue() is responsible for the entity replacement and lacks a try-catch block. When this function processes a malicious XML with an entity code point outside the valid Unicode range (e.g., &#9999999;), the call to String.fromCodePoint() throws a RangeError.

Because this exception is not caught within replaceEntitiesValue or its callers within the library, it propagates up the stack and crashes the Node.js application. The patch rectifies this by introducing a new helper function, fromCodePoint, which validates that the parsed code point is within the legal range (0 to 0x10FFFF) before calling String.fromCodePoint(). If the value is out of range, it returns the original entity string, preventing the crash. The main user-facing function that triggers this entire process is XMLParser.parse().

Vulnerable functions

OrderedObjParser.replaceEntitiesValue

src/xmlparser/OrderedObjParser.js

The vulnerability lies within anonymous functions configured for numeric entity replacement, which are called by `replaceEntitiesValue`. These functions directly passed parsed numeric entities to `String.fromCodePoint()` without validating if the number was within the valid Unicode range. An out-of-range value causes `String.fromCodePoint()` to throw a `RangeError`. The calling function, `replaceEntitiesValue`, does not handle this exception, causing it to propagate up and crash the entire Node.js process.

XMLParser.parse

src/fxp.js

This is the primary public API method that initiates the parsing process. When a user calls `parser.parse()` with malicious XML containing an out-of-range numeric entity, it internally calls the vulnerable `OrderedObjParser.replaceEntitiesValue` function, leading to an uncaught `RangeError` and a Denial of Service. This function would be at the top of the call stack from the user's perspective.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.