CVE-2026-25896: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25896 is a critical XML entity encoding bypass vulnerability in the fast-xml-parser npm package, caused by regex injection via DOCTYPE entity names. A dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow all five built-in XML entities (<, >, &, ", ') with arbitrary strings. This completely bypasses XML entity encoding and creates a direct XSS vector when parsed output is rendered in HTML, or an injection vector in SQL and other sensitive contexts. Affected versions are >= 4.1.3, < 4.5.4 and >= 5.0.0, < 5.3.5; both v5 and v6 codebases are impacted. The advisory was published on February 20, 2026, with a CVSS v3.1 base score of 9.3 (Critical) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-185 (Incorrect Regular Expression) and CWE-79 (Cross-Site Scripting). In DocTypeReader.js, entity names from DOCTYPE declarations are passed directly to RegExp() without escaping regex metacharacters: entities[entityName] = { regx: RegExp('&' + entityName + ';', 'g'), val: val }. A crafted entity name such as l. produces the regex /&l.;/g, where . matches any character — including the t in < — causing the attacker-defined entity to shadow the built-in < entity. The same flaw exists in OrderedObjParser.js (line 81, addExternalEntities) and in the v6 codebase's EntitiesParser.js, where the validateEntityName character blacklist omits .. Because DOCTYPE entities are processed before built-in entities, the attacker's replacement takes precedence with no special parser options required (processEntities: true is the default). A prior fix for CVE-2023-34104 addressed other regex metacharacters but missed the period character, which is valid in XML names per the W3C spec (GitHub Advisory, Patch Commit).

Successful exploitation constitutes a complete bypass of XML entity encoding, enabling attackers to inject arbitrary strings in place of any of the five standard XML special characters. When parsed XML content is rendered in a web page (e.g., via innerHTML, template interpolation, or SSR), this creates a direct stored or reflected XSS vector. Additionally, the & entity can be shadowed to enable SQL injection — for example, transforming O&Brien into O'; DROP TABLE users;--Brien — affecting any downstream SQL query built from parsed XML output. The scope is changed (CVSS S:C), meaning the impact extends beyond the parsing component itself to any application layer that consumes the parser's output (GitHub Advisory).

A public proof-of-concept (PoC) is included in the official security advisory and requires no special parser configuration, no authentication, and no user interaction, making exploitation trivial for any attacker who can supply untrusted XML to an affected application. As of the advisory date, there is no evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.029% (6th percentile), indicating a currently low probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Identify a target application: Find a web application or API that uses fast-xml-parser versions >= 4.1.3, < 4.5.4 or >= 5.0.0, < 5.3.5 to parse untrusted XML input and renders the parsed output in HTML or uses it in SQL queries.
2. Craft a malicious XML payload: Construct an XML document with a DOCTYPE declaration that defines entity names containing a dot (.) to shadow built-in XML entities. For XSS, use:

<!DOCTYPE root [
  <!ENTITY l. "<script>alert(1)</script>">
]>
<root><text>&lt;b&gt;World&lt;/b&gt;</text></root>

The entity l. creates regex /&l.;/g which matches <, replacing it with the injected script tag. 3. Submit the payload: Send the crafted XML to the target application's XML ingestion endpoint (e.g., via HTTP POST, file upload, or API call). 4. Trigger rendering: The application parses the XML using fast-xml-parser with default settings (processEntities: true). The DOCTYPE entity replacement runs before built-in entity decoding, so < is replaced by the attacker's value. 5. Achieve XSS or SQL injection: When the application renders result.root.text via innerHTML or a template, the injected <script> executes in the victim's browser. For SQL injection, shadow & to inject SQL metacharacters into queries built from parsed XML values (GitHub Advisory).

• Network: HTTP requests containing XML payloads with DOCTYPE declarations (<!DOCTYPE) and entity definitions using dot-containing names (e.g., <!ENTITY l. ...>, <!ENTITY g. ...>, <!ENTITY am. ...>) submitted to XML-processing endpoints.
• Logs: Application or web server logs showing XML input with <!DOCTYPE and <!ENTITY blocks containing entity names with periods; unexpected JavaScript or SQL fragments appearing in application output logs or error traces.
• Application Behavior: Unexpected script execution in browser sessions consuming XML-derived content; SQL errors or anomalous query results in applications that build queries from parsed XML; rendered HTML containing unescaped <, >, or & characters originating from XML input.
• File System: If the XSS is used to deliver a payload, look for unexpected files written by browser-side scripts or server-side template injection artifacts in web-accessible directories.

Upgrade fast-xml-parser to the patched versions: 4.5.4 (for the v4 branch) or 5.3.5 (for the v5/v6 branch). The fix escapes regex metacharacters in entity names before constructing the replacement regex: const escaped = entityName.replace(/[.\-+*:]/g, '\\.');. For v6, the . character was also added to the validateEntityName blacklist in EntitiesParser.js. As a short-term workaround where upgrading is not immediately possible, avoid passing untrusted XML to the parser, or sanitize/strip DOCTYPE declarations from XML input before parsing. IBM has issued advisories for multiple affected products (API Connect, Instana, watsonx Orchestrate, QRadar Suite, Guardium Data Security Center, and others) and should be consulted for product-specific patch guidance (GitHub Advisory, Patch Commit, IBM API Connect).

The vulnerability was reported by security researcher Ochk0 and analyzed by yuezk, with the advisory published by the fast-xml-parser maintainer (amitguptagwl) on February 20, 2026 (GitHub Advisory). The Hacker Wire published a dedicated write-up titled "fast-xml-parser: XML entity wildcard leads to XSS" shortly after disclosure (The Hacker Wire). Social media discussion appeared on Mastodon and Bluesky, and the vulnerability was featured in a PoC weekly digest (PoC Week). Red Hat filed a high-severity bug report and IBM issued advisories across more than a dozen products, reflecting broad downstream impact in enterprise software ecosystems (Red Hat Bugzilla).