CVE-2026-25128 is a denial of service vulnerability in the fast-xml-parser npm library. The vulnerability arises from a RangeError triggered during numeric entity processing when parsing XML containing out-of-range entity code points (e.g., � or �). This causes an uncaught exception that crashes any application bundling the fast-xml-parser library and processing untrusted XML input. The impact is limited to the availability of the affected application; Red Hat host systems are not impacted. Red Hat has issued a security advisory (RHSA-2026:7110) recommending upgrading to RHACS 4.8.10, which includes security patches and bug fixes addressing this issue among others.

The vulnerability causes a denial of service by crashing applications that use the fast-xml-parser library when processing maliciously crafted XML input with out-of-range numeric entities. The impact is limited to the availability of the affected application (RHACS) and does not affect the underlying Red Hat host systems. There is no confidentiality or integrity impact reported. No known exploits in the wild have been reported.

Red Hat advises upgrading to Red Hat Advanced Cluster Security (RHACS) version 4.8.10, which includes fixes for this vulnerability. No other mitigations meeting Red Hat's criteria for ease of use, deployment, and stability are currently available. Users should apply the update to benefit from the security patches and bug fixes.