CVE-2026-33349: medium-severity vulnerability in NaturalIntelligence fast-xml-parser
fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.9epss 0.5%
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero bytes — the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, completely bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded entity expansion, leading to memory exhaustion and denial of service. This issue has been patched in version 5.5.7.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
NaturalIntelligence · fast-xml-parserRelated CVEs — NaturalIntelligence fast-xml-parser
In the same product, most dangerous first.
CVE-2023-34104HIGHRegex Injection via Doctype EntitiesEPSS 1.1%CVE-2026-26278HIGHfast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)EPSS 0.9%CVE-2024-41818HIGHReDOS at currency parsing fast-xml-parserEPSS 0.8%CVE-2026-25128HIGHfast-xml-parser has RangeError DoS Numeric Entities BugEPSS 0.6%CVE-2026-33036HIGHfast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)EPSS 0.6%CVE-2026-27942LOWfast-xml-parser has stack overflow in XMLBuilder with preserveOrderEPSS 0.5%