CVE-2026-33349 Details
Description
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero bytes — the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, completely bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded entity expansion, leading to memory exhaustion and denial of service. This issue has been patched in version 5.5.7.
A denial-of-service vulnerability has been identified in fast-xml-parser versions 4.0.0-beta.3 prior to 5.5.7. The issue arises in the DocTypeReader component, where JavaScript's truthy evaluation allows developers to inadvertently disable entity processing limits. When maxEntityCount or maxEntitySize is set to 0, the parser bypasses these restrictions entirely. This flaw can be exploited by supplying XML with large entities, causing memory exhaustion and service disruption.
Users can update to fast-xml-parser versions 4.5.5 or 5.5.7, where this vulnerability has been patched. If an immediate update is not possible, as a temporary workaround, keep the processEntities option set to false.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jp2q-39xq-3w4g | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/NaturalIntelligence/fast-xml-parser/commit/239b64aa1fc5c5455ddebbbb54a187eb68c9fdb7 | [email protected] | Patch |
| https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jp2q-39xq-3w4g | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| naturalintelligence fast-xml-parser | >= 4.0.1, < 4.5.5 >= 5.0.0, < 5.5.7 4.0.0 - 4.0.0 beta3 4.0.0 beta4 4.0.0 beta5 4.0.0 beta6 4.0.0 beta7 4.0.0 beta8 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | Initial Analysis | [email protected] |
| Mar 25, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | New CVE Received | [email protected] |