GHSA-m7jm-9gc2-mpf2Published

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

cve-program · CVE-2026-25896

Published

fast-xml-parser

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "NaturalIntelligence",
                    "product": "fast-xml-parser",
                    "versions": [
                        {
                            "version": ">= 5.0.0, < 5.3.5",
                            "status": "affected"
                        },
                        {
                            "version": ">= 4.1.3, < 4.5.4",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-7529

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Feb 20, 2026, 8:57:48 PM

dateUpdated: Sep 10, 2026, 12:04:52 PM

10 related source bulletins · separate from aliases

RHSA-2026:7128: Red Hat Security Advisory: RHACS 4.9.5 security and bug fix update

CVE-2026-25128 · CVE-2026-25535 · CVE-2026-25755 · CVE-2026-25896 · CVE-2026-25940 · CVE-2026-26278 · CVE-2026-27942 · CVE-2026-31898 · CVE-2026-31938 · CVE-2026-33036 · CVE-2026-33186

RHSA-2026:6802: Red Hat Security Advisory: Red Hat Developer Hub 1.9.3 release.

CVE-2025-61140 · CVE-2025-69873 · CVE-2026-1615 · CVE-2026-2359 · CVE-2026-3304 · CVE-2026-3520 · CVE-2026-24046 · CVE-2026-25153 · CVE-2026-25639 · CVE-2026-25679 · CVE-2026-25896 · CVE-2026-26278 · CVE-2026-27606 · CVE-2026-27942 · CVE-2026-33186

RHSA-2026:6174: Red Hat Security Advisory: Red Hat Developer Hub 1.8.5 release.

CVE-2025-61140 · CVE-2026-2359 · CVE-2026-3304 · CVE-2026-3520 · CVE-2026-24046 · CVE-2026-25153 · CVE-2026-25639 · CVE-2026-25896 · CVE-2026-26278 · CVE-2026-27606 · CVE-2026-27942 · CVE-2026-33186

RHSA-2026:41941: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.18.25 security, enhancement & bug fix update

CVE-2025-12816 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-47907 · CVE-2025-58183 · CVE-2025-61726 · CVE-2025-61729 · CVE-2025-66031 · CVE-2025-68157 · CVE-2025-68458 · CVE-2025-69873 · CVE-2026-4800 · CVE-2026-25896 · CVE-2026-26278 · CVE-2026-26996 · CVE-2026-27904 · CVE-2026-27942 · CVE-2026-29063 · CVE-2026-33036 · CVE-2026-33186 · CVE-2026-34986 · CVE-2026-48779

RHSA-2026:7110: Red Hat Security Advisory: RHACS 4.8.10 security and bug fix update

CVE-2026-25128 · CVE-2026-25535 · CVE-2026-25755 · CVE-2026-25896 · CVE-2026-25940 · CVE-2026-26278 · CVE-2026-27942 · CVE-2026-29074 · CVE-2026-31898 · CVE-2026-31938 · CVE-2026-33036 · CVE-2026-33186

RHSA-2026:40984: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.20.15 security, enhancement & bug fix update

CVE-2025-12816 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-66031 · CVE-2025-68157 · CVE-2025-68458 · CVE-2025-69873 · CVE-2026-4800 · CVE-2026-22029 · CVE-2026-25128 · CVE-2026-25896 · CVE-2026-26278 · CVE-2026-26996 · CVE-2026-27904 · CVE-2026-27942 · CVE-2026-29063 · CVE-2026-33036 · CVE-2026-33186 · CVE-2026-33815 · CVE-2026-33816 · CVE-2026-34986 · CVE-2026-48779

sca-2026-0014: Fast-xml-parser vulnerabilities affect Sentio Creator Extension 'Device Manager'

CVE-2026-27942 · CVE-2026-25896 · CVE-2026-26278

RHSA-2026:51349: Red Hat Security Advisory: General availability of the satellite/iop-host-inventory-frontend-rhel9 container image

CVE-2026-13149 · CVE-2026-13676 · CVE-2026-25128 · CVE-2026-25896 · CVE-2026-26278 · CVE-2026-26996 · CVE-2026-27904 · CVE-2026-27942 · CVE-2026-33036 · CVE-2026-44990

WID-SEC-W-2026-0772: IBM App Connect Enterprise (fast-xml-parser): Mehrere Schwachstellen

CVE-2026-25896 · CVE-2026-26278

RHSA-2026:41944: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.19.20 security, enhancement & bug fix update

CVE-2025-12816 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-66031 · CVE-2025-68157 · CVE-2025-68458 · CVE-2025-69873 · CVE-2026-4800 · CVE-2026-25128 · CVE-2026-25896 · CVE-2026-26278 · CVE-2026-26996 · CVE-2026-27904 · CVE-2026-27942 · CVE-2026-29063 · CVE-2026-33036 · CVE-2026-33186 · CVE-2026-34986 · CVE-2026-48779

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-25896

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Modified

Weakness classifications: CWE-185 · CWE-79

Original publisher date fields

published: 2026-02-20T21:19:27.470

lastModified: 2026-09-10T13:17:54.697

1 source CPE criteria · context only

cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-m7jm-9gc2-mpf2

Published

fast-xml-parser

npm

SEMVER · introduced 5.0.0 → fixed 5.3.5

fast-xml-parser

npm

SEMVER · introduced 4.1.3 → fixed 4.5.4

Original source record · Cite this exact observation · Complete original publisher JSON