fast-xml-parser has RangeError DoS Numeric Entities Bug
Date: 2026-01
Affected: npm/fast-xml-parser
Attack vector: dos
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-25128
CWE: CWE-20
CWE-248
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

### Summary A RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `&#9999999;` or `&#xFFFFFF;`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. ### Details The vulnerability exists in `/src/xmlparser/OrderedObjParser.js` at lines 44-45: ```javascript "num_dec": { regex: /&#([0-9]{1,7});/g, val : (_, str) => String.fromCodePoint(Number.parseInt(str, 10)) }, "num_hex": { regex: /&#x([0-9a-fA-F]{1,6});/g, val : (_, str) => String.fromCodePoint(Number.parseInt(str, 16)) }, ``` The `String.fromCodePoint()` method throws a `RangeError` when the code point exceeds the valid Unicode range (0 to 0x10FFFF / 1114111). The regex patterns can capture values far exceeding this: - `[0-9]{1,7}` matches up to 9,999,999 - `[0-9a-fA-F]{1,6}` matches up to 0xFFFFFF (16,777,215) The entity replacement in `replaceEntitiesValue()` (line 452) has no try-catch: ```javascript val = val.replace(entity.regex, entity.val); ``` This causes the RangeError to propagate uncaught, crashing the parser and any application using it. ### PoC #### Setup Create a directory with these files: ``` poc/ ├── package.json ├── server.js ``` **package.json** ```json { "dependencies": { "fast-xml-parser": "^5.3.3" } } ``` **server.js** ```javascript const http = require('http'); const { XMLParser } = require('fast-xml-parser'); const parser = new XMLPars


Mitigations:

Architectural layers (MAESTRO):