CVE-2025-25341: libxmljs Segmentation Fault Vulnerability Leading to DoS
Summary
CVE-2025-25341: libxmljs has segmentation fault, potentially leading to a denial-of-service (DoS). Affects libxmljs versions < 1.0.11. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxmljs is a JavaScript library that provides an interface for parsing and manipulating XML documents in Node.js applications. It is widely used for its ability to handle XML data efficiently and offers features such as XPath support and XML validation. However, version 1.0.11 of libxmljs contains a critical vulnerability that can lead to a segmentation fault when processing specially crafted XML documents, exposing applications to potential denial-of-service (DoS) attacks.
Vulnerability Detail
The vulnerability in libxmljs arises from improper handling of the internal _ref property on entity_ref and entity_decl nodes during XML parsing. When an attacker supplies a specially crafted XML document, it can trigger a segmentation fault, causing the application to crash. This vulnerability can be exploited to disrupt service availability, making it a significant concern for applications relying on libxmljs for XML processing.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation to ensure that only well-formed XML documents are processed by your application. This may help mitigate the risk of triggering the vulnerability until you can update to the patched version.
Conclusion
The libxmljs vulnerability (CVE-2025-25341) poses a significant risk of denial-of-service attacks due to a segmentation fault when parsing malformed XML documents. It is crucial to update to the patched version (1.0.12 or later) to safeguard your applications. Additionally, using tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for libxmljs →
FAQ
CVE-2025-25341 is a vulnerability in libxmljs that can cause a segmentation fault when parsing specially crafted XML documents, potentially leading to a denial-of-service (DoS).
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By checking your package-lock.json file, you can determine if your application is affected by this vulnerability.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Yes, a patch is available in version 1.0.12 of libxmljs. It is recommended to update to this version or later to mitigate the vulnerability.
If you cannot update the package immediately, implement input validation to restrict the processing of potentially harmful XML documents as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxmljs.
