Add Socket patch for CVE-2026-25896 in pkg:npm/fast-xml-parser@4.3.2

[socket-security]

Summary

This PR updates Socket security patches for your dependencies.

Changes

• ✅ Added: CVE-2026-25896 in pkg:npm/fast-xml-parser@4.3.2 (Socket Patch)
  • Severity: CRITICAL
  • Summary: fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

📦 Package.json Updates

This PR automatically configures your postinstall script to apply Socket patches:

• ✅ Updated: 1 file
  • package.json

After merging, patches will automatically apply on npm install.

Testing

Review the patches and test your application to ensure compatibility.

---

🔒 Powered by Socket Security

---

Note

Medium Risk
Introduces an install-time patching step and changes XML entity handling in a third-party parser, which could affect XML parsing edge cases or build/install reliability.

Overview
Applies a Socket community patch for fast-xml-parser@4.3.2 to mitigate CVE-2026-25896, preventing DOCTYPE/external entity names from being used for regex-based entity shadowing (entity-encoding bypass).

Adds the patch artifacts under .socket/ (including DocTypeReader.js/OrderedObjParser.js replacements and a .socket/manifest.json describing the vulnerability) and updates package.json to run @socketsecurity/socket-patch apply during postinstall (and via a dependencies script) so the patch is automatically applied on install.

^{Reviewed by Cursor Bugbot for commit 1af9a5f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1af9a5f. Configure here.}

[cursor]

Missing function call makes isComment always truthy

High Severity

On line 41, isComment references the function object (defined at line 102) rather than calling it as isComment(xmlData, i). Since a function reference is always truthy in JavaScript, this condition always evaluates to true. Every other check in the chain (isEntity, isElement, isAttlist, isNotation) properly calls the function with (xmlData, i), but isComment is missing the arguments. This makes the throw new Error("Invalid DOCTYPE") on line 42 completely unreachable, and any unrecognized < tag inside a DOCTYPE body is silently treated as a comment instead of being rejected.

 

^{Reviewed by Cursor Bugbot for commit 1af9a5f. Configure here.}

[cursor]

Wrong regex replacement turns metacharacters into wildcards

Medium Severity

In addExternalEntities, the replacement string '\\.' replaces every matched metacharacter (-, +, *, :, .) with the literal string \., instead of escaping each character properly. The corresponding fix in DocTypeReader.js line 32 correctly uses '\\$&' (backslash + matched character). For example, an entity name containing - would produce \. in the regex instead of \-, turning that position into a wildcard that matches any character — reintroducing the regex injection vulnerability this patch is supposed to fix.

 

^{Reviewed by Cursor Bugbot for commit 1af9a5f. Configure here.}