npm libxmljs vulnerabilities

Latest npm libxmljs CVEs

Newest publication first

1. CVE-2025-25341 libxmljs has segmentation fault, potentially leading to a denial-of-service (DoS)

   Published 2025-12-26

   High·CVSS 7.5 EPSS 0.42%

   A vulnerability exists in the libxmljs 1.0.11 when parsing a specially crafted XML document. Accessing the internal _ref property on entity_ref and entity_decl nodes causes a segmentation fault, potentially leading to a denial-of-service (DoS).

2. CVE-2024-34392 libxmljs namespaces type confusion RCE

   Published 2024-05-02

   Critical·CVSS 9.8 EPSS 1.1%

   libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking the namespaces() function (which invokes _wrap__xmlNode_nsDef_get()) on a grand-child of a node that refers to an entity. This vulnerability can lead to denial of service...

3. CVE-2024-34391 libxmljs attrs type confusion RCE

   Published 2024-05-02

   Critical·CVSS 9.8 EPSS 1.1%

   libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking a function on the result of attrs() that was called on a parsed node. This vulnerability might lead to denial of service (on both 32-bit systems and 64-bit systems), data...

4. CVE-2022-21144 Denial of Service (DoS)

   Published 2022-05-01

   High·CVSS 7.5 EPSS 1.9%

   This affects all versions of package libxmljs. When invoking the libxmljs.parseXml function with a non-buffer argument the V8 code will attempt invoking the .toString method of the argument. If the argument's toString value is not a Function object V8 will crash.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.