Description
A RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., � or �). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input.
Recommendation
Update the fast-xml-parser package to the latest compatible version. Followings are version details:
- Affected version(s): >= 5.0.9, <= 5.3.3
- Patched version(s): 5.3.4
References
Could your website be exposed too?
SmartScanner can check your website for fast-xml-parser has RangeError DoS Numeric Entities Bug and gives you actionable findings to investigate.
Start a free scanRelated Issues
- fast-xml-parser has stack overflow in XMLBuilder with preserveOrder - CVE-2026-27942
- fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026- - CVE-2026-33036
- fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) - CVE-2026-26278
- fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names - CVE-2026-25896
You might also like:
See something that needs correcting? Let us knowUpdated February 11, 2026