CVE-2026-33036

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, &#xHH;) and standard XML entities completely evade the entity expansion limits (e.g., maxTotalExpansions, maxExpandedLength) added to fix CVE-2026-26278, enabling XML entity expansion Denial of Service. The root cause is that replaceEntitiesValue() in OrderedObjParser.js only enforces expansion counting on DOCTYPE-defined entities while the lastEntities loop handling numeric/standard entities performs no counting at all. An attacker supplying 1M numeric entity references like A can force ~147MB of memory allocation and heavy CPU usage, potentially crashing the process—even when developers have configured strict limits. This issue has been fixed in version 5.5.6.

• CWE-776

• https://github.com/NaturalIntelligence/fast-xml-parser/commit/bd26122c838e6a55e7d7ac49b4ccc01a49999a01Patch
• https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.5.6Product, Release Notes
• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8gc5-j5rx-235rExploit, Mitigation, Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33030Nginx UI is a web user interface for the Nginx web server. I…9.9
• CVE-2026-33031Nginx UI is a web user interface for the Nginx web server. P…8.1
• CVE-2026-33032Nginx UI is a web user interface for the Nginx web server. I…9.8
• CVE-2026-33033An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.…6.5
• CVE-2026-33034An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.…7.5
• CVE-2026-33035WWBN AVideo is an open source video platform. In versions 25…6.1
• CVE-2026-33037WWBN AVideo is an open source video platform. In versions 25…8.1
• CVE-2026-33038WWBN AVideo is an open source video platform. Versions 25.0 …8.1
• CVE-2026-33039WWBN AVideo is an open source video platform. In versions 25…8.6
• CVE-2026-3304Multer is a node.js middleware for handling `multipart/form-…7.5
• CVE-2026-33040libp2p-rust is the official rust language Implementation of …7.5
• CVE-2026-33041WWBN AVideo is an open source video platform. In versions 25…5.3