CVE catalog

CVE-2026-25128

node-webfont: CVE-2026-25128

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.62% · Oct 25, 2026

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `�` or `�`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-webfontsid11.4.0+dfsg2+~cs35.7.26-22not affected
Debiannode-webfontforky11.4.0+dfsg2+~cs35.7.26-22not affected
Debiannode-webfonttrixie11.4.0+dfsg2+~cs35.7.26-13not affected
Debiannode-webfontbookworm11.4.0+dfsg2+~cs35.7.26-7not affected

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-webfontsourcesidNot affectedunimportantNot reportedNot reported
Debiannode-webfontsourceforkyNot affectedunimportantNot reportedNot reported
Debiannode-webfontsourcetrixieNot affectedunimportantNot reportedNot reported
Debiannode-webfontsourcebookwormNot affectedunimportantNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [node-webfont]Not affected
    Details (2)

    • 11.4.0+dfsg2+~cs35.7.26-7 · all · bookworm

      Not affected

      dsa · node-webfont · debian · bookworm

    • 11.4.0+dfsg2+~cs35.7.26-7 · all · bookworm

      Not affected

      dsa · node-webfont · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]