Main Vulnerability Database Exploits ID:12343 - Exploit for Uncaught Exception in fast-xml-parser - CVE-2026-25128

ID:12343 - Exploit for Uncaught Exception in fast-xml-parser - CVE-2026-25128

Published: January 30, 2026

Vulnerability identifier: #VU122150

Vulnerability risk: Medium

CVE-ID: CVE-2026-25128

CWE-ID: CWE-248

Exploitation vector: Remote access

Vulnerable software:
fast-xml-parser

Link to public exploit:

https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-37qj-frw5-hhjh/#poc

Vulnerability description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the RangeError issue in the numeric entity. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Remediation

Install updates from vendor's website.