Critical advisory for fast-xml-parser
ROOT-APP-NPM-CVE-2026-25896 · Reported 2 Nov 2026
Full advisory details, affected packages, severity context, and original source.
Affected technology
Advisory overview
Root has patched CVE-2026-25896 in the fast-xml-parser package for Root:npm. Multiple fixed versions available.
Affected packages and releases
Root:npm / fast-xml-parser
introduced: 0 · fixed: 4.4.1-aikido.9 · fixed: 5.2.5-aikido.4 · fixed: 5.3.4-aikido.7 · fixed: 5.3.4-aikido.8 · fixed: 4.2.5-aikido.1 · fixed: 4.2.5-aikido.2 · fixed: 4.5.3-aikido.1 · fixed: 4.5.3-aikido.2 · fixed: 4.5.1-aikido.1 · fixed: 4.5.1-aikido.2 · fixed: 4.5.1-aikido.3 · fixed: 4.5.1-aikido.4 · fixed: 4.5.4-aikido.1
Root:npm / @rootio/fast-xml-parser
introduced: 0 · fixed: 5.3.4-root.io.2 · fixed: 4.4.1-root.io.2 · fixed: 5.3.4-root.io.3 · fixed: 4.4.1-root.io.3 · fixed: 4.4.1-root.io.4 · fixed: 5.3.4-root.io.4 · fixed: 4.4.1-root.io.5 · fixed: 4.4.1-root.io.6 · fixed: 4.4.1-root.io.7 · fixed: 5.3.4-root.io.5 · fixed: 5.2.5-root.io.2 · fixed: 4.4.1-root.io.8 · fixed: 5.2.5-root.io.3 · fixed: 5.3.4-root.io.6 · fixed: 4.4.1-root.io.9 · fixed: 5.2.5-root.io.4 · fixed: 5.3.4-root.io.7 · fixed: 5.3.4-root.io.8 · fixed: 4.2.5-root.io.1 · fixed: 4.2.5-root.io.2 · fixed: 4.5.3-root.io.1 · fixed: 4.5.3-root.io.2 · fixed: 4.5.1-root.io.1 · fixed: 4.5.1-root.io.2 · fixed: 4.5.1-root.io.3 · fixed: 4.5.1-root.io.4 · fixed: 4.5.4-root.io.1