CVE-2026-33349: fast-xml-parser Entity Expansion Limits Bypass Vulnerability
Summary
CVE-2026-33349: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser. Affects fast-xml-parser versions >= 4.0.0-beta.3, < 5.5.7. Fixed in 5.5.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fast-xml-parser is a widely used XML parsing library for Node.js that allows developers to efficiently parse XML data into JavaScript objects. It is known for its speed and lightweight nature, making it a popular choice for applications that require XML processing. However, a vulnerability exists in its handling of entity expansion limits, which can lead to denial of service attacks if not properly configured.
Vulnerability Detail
The vulnerability arises from the DocTypeReader component in fast-xml-parser, which uses JavaScript truthy checks to evaluate configuration limits for entity processing. When developers set the maxEntityCount or maxEntitySize to 0, intending to disallow entities, the falsy nature of 0 causes the checks to be bypassed. This allows attackers to exploit the vulnerability by supplying crafted XML input, leading to unbounded entity expansion and potential memory exhaustion, resulting in denial of service.
How To Fix
Latest published version: 5.11.2 as of 23 Oct 2026
npm install fast-xml-parser@5.11.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.5.7
This is the first release that contains the fix.
npm install fast-xml-parser@5.5.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you do not want to process entities at all, set the processEntities option to false instead of setting any limit to 0. Here is an example of how to configure the parser:
const { XMLParser } = require('fast-xml-parser');
const parser = new XMLParser({
processEntities: {
enabled: false
}
});
Conclusion
The CVE-2026-33349 vulnerability in fast-xml-parser poses a significant risk by allowing attackers to bypass entity limits, leading to potential denial of service. It is crucial for developers to update to the patched version or implement workarounds to mitigate this risk.
See every vulnerability recorded for fast-xml-parser →
FAQ
CVE-2026-33349 is a vulnerability in the fast-xml-parser library that allows attackers to bypass entity expansion limits, potentially leading to denial of service.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The main consequence is denial of service, as attackers can exhaust server memory by supplying crafted XML with many large entity definitions.
As a temporary measure, disable entity processing by setting the processEntities option to false in your parser configuration.
The CVSS score for this vulnerability is 5.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for fast-xml-parser.
