CVE-2026-25128: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25128 is a Denial of Service (DoS) vulnerability in the fast-xml-parser npm library caused by a RangeError in numeric entity processing. When parsing XML containing out-of-range numeric entity code points (e.g., � or �), the parser throws an uncaught exception that crashes any application processing untrusted XML input. The vulnerability affects versions 5.0.9 through 5.3.3 of the package (with some sources noting version 4.3.6 as the lower bound). It was disclosed on January 30, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Red Hat).

The root cause is improper input validation (CWE-20) combined with an uncaught exception (CWE-248) in /src/xmlparser/OrderedObjParser.js. The numeric entity definitions use String.fromCodePoint() to convert parsed integer values, but the regex patterns allow values far exceeding the valid Unicode range (0–0x10FFFF): decimal entities match up to 9,999,999 and hex entities up to 0xFFFFFF (16,777,215). The replaceEntitiesValue() function at line 452 calls val.replace(entity.regex, entity.val) with no surrounding try-catch, so the resulting RangeError: Invalid code point propagates uncaught and terminates the Node.js process. The fix in v5.3.4 introduces a fromCodePoint() wrapper that validates the code point range before calling String.fromCodePoint(), returning the original entity string if out of range (Github Advisory, Patch Commit).

Successful exploitation causes a complete crash of the Node.js process hosting the vulnerable application, resulting in a full availability loss with no impact on confidentiality or integrity. A single malicious HTTP request is sufficient to bring down the service, requiring a manual restart to recover. Affected application types include API servers accepting XML payloads, file processors parsing uploaded XML, message queue consumers, RSS/Atom feed parsers, and SOAP/XML-RPC services. Downstream IBM products incorporating fast-xml-parser — including DataPower Gateway, API Connect, Maximo Application Suite, QRadar Suite, and others — are also affected (Github Advisory, IBM DataPower Advisory).

A proof-of-concept (PoC) is publicly available in the GitHub Security Advisory, demonstrating a simple curl command that crashes a vulnerable Node.js server with a single request (Github Advisory). No authentication or user interaction is required, and the attack is executable remotely over the network with low complexity. As of the time of reporting, there is no evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.072–0.074%, placing it in the 23rd percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify target: Locate an application that accepts XML input and uses fast-xml-parser versions 5.0.9–5.3.3 (or 4.3.6–5.3.3) with processEntities: true and/or htmlEntities: true enabled — such as an API endpoint, file upload handler, or feed parser.
2. Craft malicious payload: Construct an XML document containing a numeric entity with an out-of-range Unicode code point, e.g., <root>&#9999999;</root> (decimal) or <root>&#xFFFFFF;</root> (hex).
3. Deliver the payload: Send the malicious XML to the target endpoint via HTTP POST:

   curl -X POST -H "Content-Type: application/xml" -d '<root>&#9999999;</root>' http://target/parse

4. Trigger crash: The parser calls String.fromCodePoint(9999999), which throws RangeError: Invalid code point 9999999. Because no try-catch exists in replaceEntitiesValue(), the exception propagates and crashes the entire Node.js process.
5. Result: The application becomes unavailable until manually restarted, achieving denial of service (Github Advisory).

• Logs: Node.js process crash logs or stderr output containing RangeError: Invalid code point followed by a stack trace referencing OrderedObjParser.js and String.fromCodePoint.
• Logs: Application or web server access logs showing POST requests to XML-parsing endpoints immediately preceding an unexpected process exit or service restart.
• Network: Inbound HTTP requests with XML bodies containing numeric entities matching the pattern &#[0-9]{5,7}; or &#x[0-9a-fA-F]{5,6}; with values exceeding 1,114,111 (0x10FFFF).
• Process: Unexpected Node.js process termination events or container/service restarts correlated with XML ingestion activity.

The primary remediation is to upgrade fast-xml-parser to version 5.3.4 or later, which introduces a safe fromCodePoint() wrapper that validates code points before conversion (v5.3.4 Release, Patch Commit). As a temporary workaround if immediate patching is not possible, wrap all calls to parser.parse() in a try-catch block to prevent uncaught exceptions from crashing the process, and consider implementing input validation to reject XML containing suspicious numeric entity patterns before parsing. IBM has released product-specific advisories for affected products including DataPower Gateway, API Connect, Maximo Application Suite, and others — users of those products should apply the relevant IBM security bulletins (IBM DataPower Advisory, IBM API Connect).

The vulnerability was reported by researcher mistersiddd and published by the fast-xml-parser maintainer amitguptagwl on January 30, 2026, with a patch released the same day (Github Advisory). The issue received brief coverage in security community feeds and automated vulnerability trackers. IBM issued multiple product advisories throughout April–June 2026 as the impact on its downstream products was assessed. No significant public controversy or notable researcher commentary beyond the initial disclosure has been observed.