CVE-2026-25128Disclosure(naturalintelligence / fast-xml-parser)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch naturalintelligence fast-xml-parser systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `&#9999999;` or `&#xFFFFFF;`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue.

naturalintelligence CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e387f61c4a5cef792f6a2f42467013290bf95dc

Exploit / PoC references

https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-37qj-frw5-hhjh

Other references

https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.4

Weakness type (CWE)

CWE-20CWE-248

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

fast-xml-parser

Threat summary

Patch or workaround signal is available
5 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 3d ago at 2 mentions (2026-01-30); latest day: 1
5 total mentions across 4 days

Affected systems

Vendors

naturalintelligence

Products

fast-xml-parser

Deep dive

Activity timeline5 mentions / 4d

Signal classification3 categories

Disclosure

240.0%

Patch

240.0%

General

120.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-01-30	2	Disclosure1General1
2026-02-01	1	Patch1
2026-02-23	1	Patch1
2026-03-04	1	Disclosure1

Full discourse5 posts

Cipher@elagentecapital218d
Disclosure
Report #2026-03-04-02: fast-xml-parser DoS (CVE-2026-25128) allows unauthenticated service crash via malformed numeric entities. Impact: MEDIUM-HIGH availability risk. Source: https://nvd.nist.gov/vuln/detail/CVE-2026-25128 #AI #SecOps
Post summary
The report announces a DoS vulnerability in fast-xml-parser (CVE-2026-25128) that can crash services via malformed numeric entities, posing a medium-high availability risk.
0000024
2 followersView on X
Lambda Watchdog@LambdaWatchdog227d
Patch
🔍 Lambda Watchdog detected that CVE-2026-25128 is no longer present in latest AWS Lambda base image scans. https://github.com/aws/aws-lambda-base-images/issues/393 #AWS #Lambda #Security #CVE #DevOps #SecOps
Post summary
AWS Lambda base images have been updated to remove CVE-2026-25128, indicating the vulnerability has been patched or mitigated.
0000032
30 followersView on X
PulsePatch.io@pulsepatchio249d
Patch
fast-xml-parser has a RangeError DoS vulnerability (CVE-2026-25128) affecting XML processing. Ensure updates are applied. #XML #DoS #infosec https://www.pulsepatch.io/posts/cve-2026-25128-fast-xml-parser-dos
Post summary
The tweet announces the discovery of a DoS vulnerability in fast‑xml‑parser and urges users to apply available updates to mitigate the risk.
00000167
1 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds251d
Disclosure
CVE-2026-25128 Numeric Entity Processing RangeError Vulnerability in fast-xml-parser 4.3.6-5.3.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25128
Post summary
The text announces CVE‑2026‑25128, a Numeric Entity Processing RangeError vulnerability affecting fast‑xml‑parser versions 4.3.6‑5.3.3, with no PoC, exploit, patch, or active exploitation mentioned.
0000065
4.0K followersView on X
CVE@CVEnew251d
General
CVE-2026-25128 fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.3.6 thr… https://www.cve.org/CVERecord?id=CVE-2026-25128
Post summary
The excerpt merely references CVE-2026-25128 and describes general library usage without providing exploitation, patch, or detailed technical information.
00000161
56.5K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	naturalintelligence	fast-xml-parser	-	-	-

Explore more

Back to dashboard naturalintelligence CVEs fast-xml-parser vulnerabilities

What researchers are saying

CVE-2026-25128

Cipher@elagentecapitalDisclosure

The report announces a DoS vulnerability in fast-xml-parser (CVE-2026-25128) that can crash services via malformed numeric entities, posing a medium-high availability risk.

Lambda Watchdog@LambdaWatchdogPatch

AWS Lambda base images have been updated to remove CVE-2026-25128, indicating the vulnerability has been patched or mitigated.

PulsePatch.io@pulsepatchioPatch

The tweet announces the discovery of a DoS vulnerability in fast‑xml‑parser and urges users to apply available updates to mitigate the risk.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text announces CVE‑2026‑25128, a Numeric Entity Processing RangeError vulnerability affecting fast‑xml‑parser versions 4.3.6‑5.3.3, with no PoC, exploit, patch, or active exploitation mentioned.

CVE@CVEnewGeneral

The excerpt merely references CVE-2026-25128 and describes general library usage without providing exploitation, patch, or detailed technical information.