CVE-2025-25341: 
JavaScript vulnerability analysis and mitigation

CVE-2025-25341 is a denial-of-service vulnerability in the libxmljs Node.js XML parsing library, specifically version 1.0.11. When parsing a specially crafted XML document, accessing the internal _ref property on entity_ref and entity_decl nodes triggers a segmentation fault, crashing the application. The vulnerability was originally reported on January 9, 2025, and publicly disclosed on December 26, 2025. It carries a CVSS v3.1 base score of 7.5 (High), assessed by CISA-ADP (Github Advisory, GitHub Issue).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption), stemming from improper handling of internal node properties during XML parsing. When libxmljs parses XML containing entity declarations and references, the resulting entity_ref and entity_decl node objects expose an internal _ref property; accessing this property — even indirectly via console.log() or Object.getOwnPropertyNames() — causes a segmentation fault in the underlying native C++ binding. This is similar to previously reported issues with the attr() (#645) and namespaces() (#646) methods, but is distinct in that it is triggered through direct property access rather than method calls, and affects both entity node types. No authentication or special privileges are required; any code path that parses attacker-controlled XML and subsequently inspects node properties is vulnerable (GitHub Issue, Github Advisory).

Successful exploitation causes an immediate application crash (segmentation fault), resulting in a complete denial of service for any Node.js application relying on libxmljs for XML parsing. There is no confidentiality or integrity impact confirmed at this time; however, the original reporter noted potential for data leakage if further memory corruption is achievable beyond the segfault. Applications that accept XML input from untrusted sources — such as web APIs, file upload processors, or document parsers — are at highest risk of service disruption (GitHub Issue, Github Advisory).

A proof-of-concept (PoC) exploit is publicly available in the GitHub issue tracker, demonstrating the crash with a minimal XML document and a few lines of Node.js code (GitHub Issue). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.017–0.032%, indicating a low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Identify target: Locate a Node.js application that uses libxmljs version 1.0.11 (or earlier) to parse XML input, particularly one that accepts XML from external or untrusted sources (e.g., an API endpoint, file upload handler).
2. Craft malicious XML: Prepare an XML document containing an entity declaration and a reference to that entity, such as:

<!DOCTYPE foo [<!ENTITY writer "Bob">]>
<foo><from>&writer;</from></foo>

3. Submit the payload: Send the crafted XML document to the target application's XML parsing endpoint via HTTP request, file upload, or any other supported input channel.
4. Trigger the segfault: The application parses the XML with libxmljs; if any code path accesses the _ref property on the resulting entity_ref or entity_decl node (e.g., via console.log(node) or property enumeration), a segmentation fault is triggered.
5. Achieve DoS: The Node.js process crashes, causing service unavailability for all users of the application until it is restarted (GitHub Issue).

• Logs: Sudden Node.js process termination with Segmentation fault (core dumped) in application or system logs; unexpected process restarts logged by process managers (e.g., PM2, systemd).
• Network: Repeated HTTP requests containing XML payloads with entity declarations (<!DOCTYPE / <!ENTITY) targeting XML-parsing endpoints, especially from a single source IP.
• File System: Core dump files (e.g., core, core.<pid>) generated in the application working directory following crashes.
• Process: Abnormal termination of the Node.js process (exit code indicating signal 11/SIGSEGV) observable via process monitoring tools or OS-level audit logs (GitHub Issue).

The GitHub Advisory Database notes that all versions up to and including 1.0.11 are affected, with no patched version currently listed in the advisory (Github Advisory). Feedly patch details indicate a patch was added on December 26, 2025 — users should check the libxmljs repository for any releases beyond 1.0.11 and upgrade immediately if available. As interim mitigations: validate and sanitize all XML input before passing it to libxmljs; avoid exposing XML parsing functionality directly to untrusted input; implement rate limiting on XML-parsing endpoints; and consider replacing libxmljs with an actively maintained alternative if no patch is available. Monitor for unexpected application crashes as a potential indicator of exploitation attempts.

The vulnerability received brief coverage from security news aggregators including TheHackerWire on Mastodon and Bluesky shortly after disclosure. Red Hat acknowledged the CVE in their security advisory tracker. No significant vendor statements or notable researcher commentary beyond the original GitHub issue report have been identified (Github Advisory).