StackRadar

CVE-2026-25128

High

Advisory

Published 30 Jan 2026In the index since 8 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
22
of 17,781 indexed, latest versions
Container images
21
deployed by those charts
Fix available
1 of 1
affected package

fast-xml-parser has RangeError DoS Numeric Entities Bug

Carried by container images the latest versions of 22 of 17,781 indexed charts deploy, on 21 images.

Affected packageAffected versionsFixed inImages
fast-xml-parsernpm5.0.9, 5.2.1, 5.2.55.3.421
OSV records
GHSA-37qj-frw5-hhjh

Charts affected

22 by stars
ChartLatestAffected imagesRadar Score
kenerkenerVerified publisher0.2.01 of 1See more

kener kener 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
fast-xml-parser@5.2.1
5.3.4

Open the chart page →

5,228
uptime-kumapascaliskeVerified publisher3.0.01 of 1See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
fast-xml-parser@5.2.5
5.3.4

Open the chart page →

6,883
uptime-kumasb-helm-charts0.4.01 of 1See more

uptime-kuma sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.24c364ef96aad
fast-xml-parser@5.2.5
5.3.4

Open the chart page →

38,107
activepiecesadnoctemVerified publisher0.5.01 of 1See more

activepieces adnoctem 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
activepieces/activepieces:0.90.430c10a04fe3d
fast-xml-parser@5.2.5
5.3.4

Open the chart page →

1,055
ghostchart-ghost0.1.51 of 2See more

ghost chart-ghost 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
library/ghost:6.22.0-alpine3.23ac533a6988ee
fast-xml-parser@5.2.5
5.3.4

Open the chart page →

4,083
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad2 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

2 of the 6 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
fast-xml-parser@5.2.5
5.3.4
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
fast-xml-parser@5.2.5
5.3.4

Open the chart page →

18,293
uptime-kumafluent-operatorVerified publisher0.1.01 of 1See more

uptime-kuma fluent-operator 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
louislam/uptime-kuma:13d632903e6af
fast-xml-parser@5.2.5
5.3.4

Open the chart page →

3,474
librechathajowielandVerified publisher1.1.01 of 1See more

librechat hajowieland 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
fast-xml-parser@5.0.9
5.3.4

Open the chart page →

2,950
kenerkener-chart0.0.71 of 1See more

kener kener-chart 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
fast-xml-parser@5.2.1
5.3.4

Open the chart page →

5,228
pangolinkrzwiatrzyk0.11.01 of 1See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
fosrl/pangolin:1.13.0c32ad797ab96
fast-xml-parser@5.2.5
5.3.4

Open the chart page →

3,441
homepagekubernetes-homelab-helm-chartsVerified publisher0.1.01 of 1See more

homepage kubernetes-homelab-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
fast-xml-parser@5.2.5
5.3.4

Open the chart page →

1,378
uptime-kumakubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

uptime-kuma kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.2.1-slim059b49d64739
fast-xml-parser@5.2.5
5.3.4

Open the chart page →

6,356
uptime-kumalbenicio-communityVerified publisher0.1.11 of 1See more

uptime-kuma lbenicio-community 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
fast-xml-parser@5.2.5
5.3.4

Open the chart page →

33,242
uptime-kumaloeken-at-homeVerified publisher2.3.21 of 1See more

uptime-kuma loeken-at-home 2.3.2

1 of the 1 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
fast-xml-parser@5.2.5
5.3.4

Open the chart page →

33,242
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
fast-xml-parser@5.2.5
5.3.4

Open the chart page →

4,960
bluesky-pdsnerkho-helm-charts0.4.21 of 1See more

bluesky-pds nerkho-helm-charts 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4.204cbc6e3ea157d
fast-xml-parser@5.2.5
5.3.4

Open the chart page →

2,383
outscale-s3-exploreroutscale-s3-explorer0.1.41 of 1See more

outscale-s3-explorer outscale-s3-explorer 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
ghcr.io/solucteam/outscale-s3-explorer:v1.0.09665c3e71889
fast-xml-parser@5.2.5
5.3.4

Open the chart page →

1,811
claude-relayrevolution10.1.371 of 4See more

claude-relay revolution1 0.1.37

1 of the 4 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
fast-xml-parser@5.2.5
5.3.4

Open the chart page →

4,600
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
fast-xml-parser@5.2.5
5.3.4

Open the chart page →

5,819
joplintobiassackmann0.1.71 of 2See more

joplin tobiassackmann 0.1.7

1 of the 2 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
joplin/server:latest3f7b852959aa
fast-xml-parser@5.2.5
5.3.4

Open the chart page →

5,535
kenerunxwaresVerified publisher2026.2.51 of 1See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
fast-xml-parser@5.2.1
5.3.4

Open the chart page →

5,228
evolution-apivcnngrVerified publisher1.0.01 of 5See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-25128.

Container imageDigestPackageFixed in
evoapicloud/evolution-api:latest966625532d90
fast-xml-parser@5.2.5
5.3.4

Open the chart page →

3,746

Container images carrying it

21 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
louislam/uptime-kuma:2.3.29aeb4e51d038
fast-xml-parser@5.2.5
5.3.4
2
rajnandan1/kener:3.2.1930407afca731
fast-xml-parser@5.2.1
5.3.4
2
activepieces/activepieces:0.90.430c10a04fe3d
fast-xml-parser@5.2.5
5.3.4
1
evoapicloud/evolution-api:latest966625532d90
fast-xml-parser@5.2.5
5.3.4
1
fosrl/pangolin:1.13.0c32ad797ab96
fast-xml-parser@5.2.5
5.3.4
1
joplin/server:latest3f7b852959aa
fast-xml-parser@5.2.5
5.3.4
1
library/ghost:6.25.12654b1e90413
fast-xml-parser@5.2.5
5.3.4
1
library/ghost:6.22.0-alpine3.23ac533a6988ee
fast-xml-parser@5.2.5
5.3.4
1
louislam/uptime-kuma:2.2.1-slim059b49d64739
fast-xml-parser@5.2.5
5.3.4
1
louislam/uptime-kuma:13d632903e6af
fast-xml-parser@5.2.5
5.3.4
1
louislam/uptime-kuma:2.0.24c364ef96aad
fast-xml-parser@5.2.5
5.3.4
1
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
fast-xml-parser@5.2.5
5.3.4
1
ghcr.io/bluesky-social/pds:0.4.204cbc6e3ea157d
fast-xml-parser@5.2.5
5.3.4
1
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
fast-xml-parser@5.0.9
5.3.4
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
fast-xml-parser@5.2.5
5.3.4
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
fast-xml-parser@5.2.5
5.3.4
1
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
fast-xml-parser@5.2.5
5.3.4
1
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
fast-xml-parser@5.2.1
5.3.4
1
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
fast-xml-parser@5.2.5
5.3.4
1
ghcr.io/solucteam/outscale-s3-explorer:v1.0.09665c3e71889
fast-xml-parser@5.2.5
5.3.4
1
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
fast-xml-parser@5.2.5
5.3.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.