Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero bytes — the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, completely bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded entity expansion, leading to memory exhaustion and denial of service. This issue has been patched in version 5.5.7.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-33349 XML Entity Expansion Vulnerability in fast-xml-parser Before 5.5.7 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33349
Post summary
A disclosure of an XML entity expansion flaw in fast‑xml‑parser below v5.5.7, with a Vulmon reference; no exploit evidence or patch information is provided.
8 of 8 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | naturalintelligence | fast-xml-parser | - | - | - |
| App | naturalintelligence | fast-xml-parser | 4.0.0 | - | - |
| App | naturalintelligence | fast-xml-parser | 4.0.0 | - | - |
| App | naturalintelligence | fast-xml-parser | 4.0.0 | - | - |
| App | naturalintelligence | fast-xml-parser | 4.0.0 | - | - |
| App | naturalintelligence | fast-xml-parser | 4.0.0 | - | - |
| App | naturalintelligence | fast-xml-parser | 4.0.0 | - | - |
| App | naturalintelligence | fast-xml-parser | 4.0.0 | - | - |