CVE-2026-25896

EUVD-2026-7529

20.02.2026, 21:19

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (&lt;, &gt;, &amp;, &quot;, &apos;) with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.

Cross-site Scripting

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.3 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 38.44%

Affected Products (NVD)

Vendor	Product	Version
naturalintelligence	fast-xml-parser	4.1.3 ≤ 𝑥 < 5.3.5

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Red Hat	Red Hat Advanced Cluster Security 4.8	1775594119 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Advanced Cluster Security 4.9	1775594284 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Developer Hub 1.8	1774545605 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Developer Hub 1.9	1775140647 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783676191 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783929816 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1784094353 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1784093953 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1784094943 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783676585 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783676649 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783676675 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1784094299 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1784094725 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783676820 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783676883 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783676894 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1784095175 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783676977 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1784093503 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783677297 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783677345 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1783677533 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783684360 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783684068 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1784054582 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1784054606 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1784055295 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783684603 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783684668 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783684667 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1784054873 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783684707 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1784055589 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783684779 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783684831 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783684839 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1784055533 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1784055558 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1784056134 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783685128 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783685129 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1783685375 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1783667125 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1783666755 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1784054598 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1784055387 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1784055726 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1783667517 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1783667577 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1783667611 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1784055020 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1783667641 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1784055586 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1783667790 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1783667859 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1783667875 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1783667869 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1783667877 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1784055576 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1784055244 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1784055382 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1783668266 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1783668288 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.20	1783669219 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Satellite 6.18	1785922764 ≤ 𝑥 < *	ADP