What is the CVSS score of CVE-2026-25896?

CVE-2026-25896 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-25896?

Yes, a public proof-of-concept exploit is available for CVE-2026-25896. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25896?

Within 24 hours: Inventory all applications and dependencies using Fast-Xml-Parser and identify affected systems in production and development environments. Within 7 days: Apply vendor patch to upgrade Fast-Xml-Parser to version 5.3.6 or later across all systems; test patches in staging environment before production deployment. Within 30 days: Verify patch deployment across all systems through vulnerability scanning, implement change management documentation, and conduct post-incident review to prevent similar exposure gaps.

Fast Xml Parser CVE-2026-25896

CRITICAL

Incorrect Regular Expression (CWE-185)

2026-02-20 security-advisories@github.com

GHSA-m7jm-9gc2-mpf2

XSS Fast Xml Parser Naturalintelligence

9.3

CVSS 3.1 · Vendor: github

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft XML with DOCTYPE entity containing dot wildcard
Exploit

Shadow built-in XML entities with malicious values
Execution

Inject arbitrary HTML/JavaScript payload
Impact

Execute XSS in rendered output

Vulnerability Assessment

Weakness	CWE CWE-185 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V2 - Validation and Business Logic Incorrect input validation
Exploitation Conditions	No special conditions — remote unauthenticated exploitation against fast-xml-parser versions 4.1.3 to before 5.3.5 with default parsing configuration. Requires attacker-controlled XML input processed and rendered in web context.
Impact	CVSS 9.3. Denial of service via crafted XML.
Exploit ScenarioDerived	Crafted XML triggers catastrophic regex backtracking.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

ReDoS in fast-xml-parser before fix via crafted XML. PoC and patch available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:04 CVSS 9.3

ReDoS in fast-xml-parser XML library.

RemediationAI

Apply patch.

Affected Packages

npm fast-xml-parser fix: 4.5.4, 5.3.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-185 incorrect regex in XML parsing.

Know when Fast Xml Parser gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Red Hat 7.1 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

PoC Detected

Mar 02, 2026 - 14:54 vuln.today

Public exploit code

Patch released

Mar 02, 2026 - 14:54 nvd

Patch available

CVE Published

Feb 20, 2026 - 21:19 nvd

CRITICAL 9.3

DescriptionCVE.org

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.

Executive ViewAI

Why It Matters

Fast-Xml-Parser versions up to 5.3.5 contain a critical vulnerability (CVSS 9.3) that allows remote attackers to execute arbitrary code through XML processing. This affects any application using the vulnerable library for XML parsing, validation, or building, potentially enabling complete system compromise. Public exploits are available, making this an urgent threat requiring immediate remediation.

Business Impact: Severe

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.0%

Top 88% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

NVD

CVE.org

EPSS Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.