PT-2026-26487 · Unknown · Fast-Xml-Parser

Restriction · Published 2026-03-19 · Updated 2026-05-18 · CVE-2026-33349

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions fast-xml-parser versions 4.0.0-beta.3 through 5.5.6

Description The DocTypeReader in fast-xml-parser incorrectly uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer sets either limit to 0, intending to disallow all entities or restrict entity size to zero bytes, the falsy nature of 0 in JavaScript causes the guard conditions to be bypassed, completely ignoring the limits. An attacker supplying XML input to an application can trigger unbounded entity expansion, leading to memory exhaustion and denial of service. This issue affects applications that explicitly set these limits to 0, as the default configuration is not vulnerable.

Recommendations Versions 4.0.0-beta.3 through 5.5.6 should be updated to version 5.5.7 or later. As an alternative, if you do not want to process entities, set the processEntities flag to false instead of setting any limit to 0.

Exploit

Fix

Weakness Enumeration

CWE-1284

Related Identifiers

CLEANSTART-2026-AD27625

CVE-2026-33349

GHSA-JP2Q-39XQ-3W4G

Affected Products

Fast-Xml-Parser

References · 85

• 🔥 https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jp2q-39xq-3w4g · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33349.json · Exploit
• https://github.com/NaturalIntelligence/fast-xml-parser/commit/239b64aa1fc5c5455ddebbbb54a187eb68c9fdb7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33349 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33036 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31802 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-69873 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-26960 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4926 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33349 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33349 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41650 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-2950 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33349 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23745 · Security Note