Main Vulnerability Database Vulnerabilities #VU123128

Incorrect Regular Expression in fast-xml-parser - CVE-2026-25896

Published: February 23, 2026

Vulnerability identifier: #VU123128

CSH Severity: Medium

CVSS v4: 7.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N]

CVE-ID: CVE-2026-25896

CWE-ID: CWE-185

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient input validation when processing regular expressions in DOCTYPE entity names. A remote attacker can bypass the XML entity encoding.

Affected software

fast-xml-parser
Cognos Analytics Mobile (iOS)
Cognos Analytics Mobile (Android)
Guardium Data Security Center (GDSC)
Maximo Application Suite Ai Service
IBM App Connect Enterprise
OpenShift Data Foundation (formerly OpenShift Container Storage)
App Connect Enterprise Certified Container

How to mitigate CVE-2026-25896

Install updates from vendor's website.

fast-xml-parser - update to 5.3.5
Cognos Analytics Mobile (iOS) - update to 1.1.26
Cognos Analytics Mobile (Android) - update to 1.1.26
Guardium Data Security Center (GDSC) - update to 3.8.8
Maximo Application Suite Ai Service - update to 9.1.13
IBM App Connect Enterprise - addressed in versions 12.0.12.24, 13.0.6.2
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.18.25, 4.19.20
App Connect Enterprise Certified Container - addressed in versions 12.0.22, 13.0.0

Links to Public Exploits and PoC-codes

Exploit #12434 - Entity encoding bypass via regex injection in DOCTYPE entity names (February 23, 2026)

External References

https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-m7jm-9gc2-mpf2