CVE-2026-25128: fast-xml-parser Denial of Service Vulnerability Due to RangeError in Numeric Entities

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

fast-xml-parser is a popular XML parsing library for Node.js that allows developers to easily convert XML data into JavaScript objects. It is widely used for processing XML payloads in various applications, including API servers, file processors, and message queues. However, the library has a vulnerability that can lead to a Denial of Service (DoS) when handling malformed numeric entities in XML input.

Vulnerability Detail

A RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., '�' or '�'). This issue arises from the use of the String.fromCodePoint() method, which throws a RangeError when the code point exceeds the valid Unicode range (0 to 0x10FFFF). The regex patterns used in the parser can capture values far exceeding this range, leading to an uncaught exception that crashes the application. This vulnerability affects any application using fast-xml-parser to process untrusted XML input, resulting in potential service disruption.

npm install fast-xml-parser@5.11.2

npm install fast-xml-parser@5.3.4

Workaround

As a temporary workaround, you can implement a try-catch block around the parsing logic to handle potential RangeErrors gracefully. Here is an example of how to modify your server.js file:

const http = require('http');
const { XMLParser } = require('fast-xml-parser');

const parser = new XMLParser({ processEntities: true, htmlEntities: true });

http.createServer((req, res) => {
  if (req.method === 'POST' && req.url === '/parse') {
    let body = '';
    req.on('data', c => body += c);
    req.on('end', () => {

  try {

        const result = parser.parse(body);
        res.end(JSON.stringify(result));
      } catch (error) {
        res.statusCode = 400;
        res.end('Invalid XML input');
      }
    });
  } else {
    res.end('POST /parse with XML body');
  }
}).listen(3000, () => console.log('http://localhost:3000'));

Conclusion

The fast-xml-parser library has a critical vulnerability that can lead to Denial of Service when processing malformed numeric entities in XML input. It is essential to update to the patched version to mitigate this risk. Implementing a try-catch block can serve as a temporary workaround while you update the library.

See every vulnerability recorded for fast-xml-parser →

FAQ