9.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25896

CVE-2026-25896: fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25896

CVE-2026-25896:

9.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fast-xml-parser	npm	>= 5.0.0, < 5.3.5	5.3.5
fast-xml-parser	npm	>= 4.1.3, < 4.5.4	4.5.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper construction of regular expressions from user-controllable XML entity names. The fast-xml-parser library uses regular expressions to replace XML entities, but it failed to escape special regex characters within the entity names, specifically the dot ('.'). According to the XML specification, a dot is a valid character in an entity name. However, in a regular expression, a dot is a wildcard that matches any character.

An attacker can define a DOCTYPE entity with a name like 'l.'. The parser would then create a regex like /&l.;/g. When this regex is applied to the XML body, it will match not only &l.; but also < because the dot matches the 't'. Since DOCTYPE entities are processed before built-in entities (<, >, etc.), the attacker's entity value replaces the standard entity, effectively bypassing the entity encoding mechanism. This allows for the injection of arbitrary strings, leading to Cross-Site Scripting (XSS) when the parsed output is rendered in an HTML context, or other injection attacks depending on the context where the output is used.

The patches address this by escaping regex metacharacters in the entity name before creating the RegExp object. The analysis of the provided commits confirms this vulnerability and fix in multiple locations across the codebase, specifically in DocTypeReader.js, OrderedObjParser.js, and v6/EntitiesParser.js.

Vulnerable functions

addExternalEntities

src/xmlparser/OrderedObjParser.js

The function `addExternalEntities` is vulnerable because it uses an unescaped entity name `ent` to construct a regular expression. An attacker can provide a crafted entity name containing a dot ('.') which is treated as a wildcard in the regex, allowing them to shadow built-in XML entities and inject arbitrary content.

EntitiesParser.addExternalEntity

src/v6/EntitiesParser.js

The function `addExternalEntity` in the `EntitiesParser` class is vulnerable. It uses the `key` (entity name) directly in a `RegExp` constructor without proper escaping. This allows an attacker to use regex metacharacters like '.' to create a regex that can override standard XML entities, leading to potential XSS or other injection attacks.

DocTypeReader.read

src/xmlparser/DocTypeReader.js

The `read` method of the `DocTypeReader` class is vulnerable because it constructs a regular expression from an `entityName` without escaping special characters. A malicious DOCTYPE entity with a '.' in its name can create a regex that incorrectly matches and replaces standard entities like `<`, enabling XSS.

EntitiesParser.parse

src/v6/EntitiesParser.js

The `parse` method of the `EntitiesParser` class processes DOCTYPE entities. It is vulnerable because it creates a regular expression from the entity name `ent` without escaping it. This allows an attacker to inject regex metacharacters, such as a dot, to hijack the entity replacement mechanism and inject malicious content.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.