CVE-2026-33349

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero bytes — the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, completely bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded entity expansion, leading to memory exhaustion and denial of service. This issue has been patched in version 5.5.7.

• CWE-1284

• https://github.com/NaturalIntelligence/fast-xml-parser/commit/239b64aa1fc5c5455ddebbbb54a187eb68c9fdb7Patch
• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jp2q-39xq-3w4gExploit, Mitigation, Vendor Advisory
• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jp2q-39xq-3w4gExploit, Mitigation, Vendor Advisory

Published

Mar 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33343etcd is a distributed key-value store for the data of a dist…6.5
• CVE-2026-33344Dagu is a workflow engine with a built-in Web user interface…8.1
• CVE-2026-33345solidtime is an open-source time-tracking app. Prior to vers…6.5
• CVE-2026-33346OpenEMR is a free and open source electronic health records …8.7
• CVE-2026-33347league/commonmark is a PHP Markdown parser. From version 2.3…6.1
• CVE-2026-33348OpenEMR is a free and open source electronic health records …5.4
• CVE-2026-3335The Canto plugin for WordPress is vulnerable to Missing Auth…5.3
• CVE-2026-33350LORIS (Longitudinal Online Research and Imaging System) is a…7.5
• CVE-2026-33351WWBN AVideo is an open source video platform. Prior to versi…9.1
• CVE-2026-33352WWBN AVideo is an open source video platform. Prior to versi…9.8
• CVE-2026-33353Soft Serve is a self-hostable Git server for the command lin…6.5
• CVE-2026-33354WWBN AVideo is an open source video platform. In versions up…6.5