fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero bytes — the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, completely bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded entity expansion, leading to memory exhaustion and denial of service. This issue has been patched in version 5.5.7.
References
| Link | Resource |
|---|---|
| https://github.com/NaturalIntelligence/fast-xml-parser/commit/239b64aa1fc5c5455ddebbbb54a187eb68c9fdb7 | Patch |
| https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jp2q-39xq-3w4g | Exploit Mitigation Vendor Advisory |
| https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jp2q-39xq-3w4g | Exploit Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
26 Mar 2026, 13:01
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta4:*:*:*:*:*:* cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:* cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta3:*:*:*:*:*:* cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta5:*:*:*:*:*:* cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta8:*:*:*:*:*:* cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta7:*:*:*:*:*:* cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:-:*:*:*:*:*:* cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta6:*:*:*:*:*:* |
|
| References | () https://github.com/NaturalIntelligence/fast-xml-parser/commit/239b64aa1fc5c5455ddebbbb54a187eb68c9fdb7 - Patch | |
| References | () https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jp2q-39xq-3w4g - Exploit, Mitigation, Vendor Advisory | |
| First Time |
Naturalintelligence
Naturalintelligence fast-xml-parser |
25 Mar 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jp2q-39xq-3w4g - |
24 Mar 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-24 20:16
Updated : 2026-03-26 13:01
NVD link : CVE-2026-33349
Mitre link : CVE-2026-33349
CVE.ORG link : CVE-2026-33349
JSON object : View
Products Affected
naturalintelligence
- fast-xml-parser
CWE
CWE-1284
Improper Validation of Specified Quantity in Input