CVE-2026-33036: fast-xml-parser Numeric Entity Expansion Bypass Vulnerability
Summary
CVE-2026-33036: The fix for CVE-2026-26278 added entity expansion limits (maxTotalExpansions, maxExpandedLength, maxEntityCount, maxEntitySize) to prevent XML entity expansion Denial of Service. Affects fast-xml-parser versions >= 4.0.0-beta.3, < 5.5.6. Fixed in 5.5.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fast-xml-parser is a widely used XML parser for JavaScript that allows developers to easily convert XML data into JavaScript objects. It is known for its performance and flexibility, offering features such as entity processing and customizable parsing options. However, it has a vulnerability that allows attackers to bypass entity expansion limits, leading to potential Denial of Service (DoS) attacks.
Vulnerability Detail
The vulnerability arises from an incomplete fix for CVE-2026-26278, where the entity expansion limits are only enforced for DOCTYPE-defined entities. Numeric character references and standard XML entities are processed through a separate code path that does not enforce these limits. An attacker can exploit this by using a large number of numeric entity references, causing excessive memory allocation and CPU consumption, potentially leading to application crashes.
How To Fix
Latest published version: 5.11.2 as of 23 Oct 2026
npm install fast-xml-parser@5.11.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.5.6
This is the first release that contains the fix.
npm install fast-xml-parser@5.5.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable HTML entity processing by setting the 'htmlEntities' option to false in the XMLParser configuration. Here is an example of how to implement this:
const { XMLParser } = require('fast-xml-parser');
const parser = new XMLParser({
processEntities: {
enabled: true,
htmlEntities: false
}
});
Conclusion
The fast-xml-parser package has a significant vulnerability that allows numeric entity expansion to bypass limits, leading to potential Denial of Service. It is crucial to update to the patched version or implement workarounds to mitigate the risk.
See every vulnerability recorded for fast-xml-parser →
FAQ
CVE-2026-33036 is a vulnerability in the fast-xml-parser package that allows numeric entity expansion to bypass configured limits, potentially leading to Denial of Service.
An attacker can exploit this vulnerability by providing XML input with a large number of numeric entity references, causing excessive memory and CPU usage.
The potential impacts include excessive memory allocation, high CPU consumption, and possible application crashes due to out-of-memory errors.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for fast-xml-parser.
