Security Digest: February 20, 2026 - 1 Critical Vulnerability

Today, a severe vulnerability in the fast-xml-parser library affecting both versions 5 and 6 has been identified.

· 2 min read

Urgent Alert: Critical XML Vulnerability in Fast-XML-Parser

Immediate action required: A critical vulnerability, CVE-2026-25896, has been discovered in the fast-xml-parser library, allowing attackers to bypass XML entity encoding via regex injection in DOCTYPE entity names.

Executive Summary

Today, a severe vulnerability in the fast-xml-parser library affecting both versions 5 and 6 has been identified. It allows attackers to substitute built-in XML entities with arbitrary strings, leading to potential XSS and SQL injection attacks. Immediate mitigation steps are necessary for all affected systems.

Critical Vulnerabilities

CVE-2026-25896: Entity Encoding Bypass via Regex Injection

  • Impact: Allows attackers to completely bypass XML entity encoding, leading to potential XSS and SQL injection vulnerabilities when parsed output is rendered.
  • Affected Systems: Fast-xml-parser library, versions 5 and 6.
  • Immediate Action: Implement the provided workaround to escape regex metacharacters in entity names.
  • Mitigation: Adjust code to escape regex metacharacters before constructing replacement regexes and update the blacklist in `validateEntityName` to include the dot character.

What to Do Now

  1. Immediately update your fast-xml-parser to use the workaround provided to escape regex metacharacters.
  2. Verify that no untrusted XML inputs are processed without this protection in place.
  3. Monitor application logs for any unusual entity parsing behavior.

Related Resources

Keep reading