CVE-2026-25128

Description

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., or. This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue.

Risk Information

Base Score

7.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

0.054

Associated Vulnerability

Vulnerability	OS Platform
Multiple Vulnerabilities are affected in IBM App Connect Enterprise 12.0.12.22	Windows
Multiple Vulnerabilities are affected in IBM App Connect Enterprise 13.0.6.1	Windows
Multiple Vulnerabilities are affected in IBM Planning Analytics Local 2.1.18	Windows

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234