{"action":"Upgrade fast-xml-parser to 4.5.4 or later.","affected":[{"fixed":"5.3.5","introduced":"5.0.0"},{"fixed":"4.5.4","introduced":"4.1.3"}],"component":"fast-xml-parser","cve_ids":["CVE-2026-25896"],"ecosystem":"npm","epss":0.00527,"exploited":false,"fixed_versions":["5.3.5","4.5.4"],"ghsa_id":"GHSA-m7jm-9gc2-mpf2","id":"tcs_01M5KG00MPGCF03PJD800615F0","modified_at":"2026-09-10T03:50:35.317514651Z","published_at":"2026-02-20T18:23:54Z","references":["https://osv.dev/vulnerability/GHSA-m7jm-9gc2-mpf2","https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-m7jm-9gc2-mpf2","https://nvd.nist.gov/vuln/detail/CVE-2026-25896","https://github.com/NaturalIntelligence/fast-xml-parser/commit/943ef0eb1b2d3284e72dd74f44a042ee9f07026e","https://github.com/NaturalIntelligence/fast-xml-parser/commit/ddcd0acf26ddd682cb0dc15a2bd6aa3b96bb1e69","https://github.com/NaturalIntelligence/fast-xml-parser","https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.5"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-m7jm-9gc2-mpf2","url":"https://osv.dev/vulnerability/GHSA-m7jm-9gc2-mpf2"}],"summary":"fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names"}