Read the docs
TI-2026-25482 Aliases CVE-2026-33036GHSA-8gc5-j5rx-235r

fast-xml-parser affected by numeric entity expansion bypassing all entity expansion…

Priority HIGH 72CWE-776Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 9 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, &#xHH;) and standard XML entities completely evade the entity expansion limits (e.g., maxTotalExpansions, maxExpandedLength) added to fix CVE-2026-26278, enabling XML entity expansion Denial of Service. The root cause is that replaceEntitiesValue() in OrderedObjParser.js only enforces expansion counting on DOCTYPE-defined entities while the lastEntities loop handling numeric/standard entities performs no counting at all. An attacker supplying 1M numeric entity references like A can force ~147MB of memory allocation and heavy CPU usage, potentially crashing the process—even when developers have configured strict limits. This issue has been fixed in version 5.5.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00612 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial fast-xml-parser (NaturalIntelligence): 5.5.6fast-xml-parser (npm): 5.5.6, 4.5.5Red Hat: 12 advisoriesRed Hat: 9 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NaturalIntelligencefast-xml-parser4.0.0-beta.3 to before 5.5.65.5.6Patch availableCNA
—fast-xml-parser (npm)5.0.0 to before 5.5.65.5.6Patch availableGHSA-8gc5-j5rx-235r
—fast-xml-parser (npm)4.0.0-beta.3 to before 4.5.54.5.5Patch availableGHSA-8gc5-j5rx-235r
  • fast-xml-parser VendorNaturalIntelligence Affected 4.0.0-beta.3 to before 5.5.6 Fixed in 5.5.6 Patch available CNA
  • fast-xml-parser (npm) Vendor— Affected 5.0.0 to before 5.5.6 Fixed in 5.5.6 Patch available GHSA-8gc5-j5rx-235r
  • fast-xml-parser (npm) Vendor— Affected 4.0.0-beta.3 to before 4.5.5 Fixed in 4.5.5 Patch available GHSA-8gc5-j5rx-235r

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*4.0.1 to before 5.5.6VulnerableNaturalIntelligence
cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:-:*:*:*:*:*:*4.0.0VulnerableNaturalIntelligence
cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta3:*:*:*:*:*:*4.0.0 beta3VulnerableNaturalIntelligence
cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta4:*:*:*:*:*:*4.0.0 beta4VulnerableNaturalIntelligence
cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta5:*:*:*:*:*:*4.0.0 beta5VulnerableNaturalIntelligence
cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta6:*:*:*:*:*:*4.0.0 beta6VulnerableNaturalIntelligence
cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta7:*:*:*:*:*:*4.0.0 beta7VulnerableNaturalIntelligence
cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta8:*:*:*:*:*:*4.0.0 beta8VulnerableNaturalIntelligence
  • cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:* Versions 4.0.1 to before 5.5.6 Vulnerable ·NaturalIntelligence
  • cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:-:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·NaturalIntelligence
  • cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta3:*:*:*:*:*:* Versions 4.0.0 beta3 Vulnerable ·NaturalIntelligence
  • cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta4:*:*:*:*:*:* Versions 4.0.0 beta4 Vulnerable ·NaturalIntelligence
  • cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta5:*:*:*:*:*:* Versions 4.0.0 beta5 Vulnerable ·NaturalIntelligence
  • cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta6:*:*:*:*:*:* Versions 4.0.0 beta6 Vulnerable ·NaturalIntelligence
  • cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta7:*:*:*:*:*:* Versions 4.0.0 beta7 Vulnerable ·NaturalIntelligence
  • cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta8:*:*:*:*:*:* Versions 4.0.0 beta8 Vulnerable ·NaturalIntelligence

Remediation

  • Fix · CNA fast-xml-parser (NaturalIntelligence) Fixed in 5.5.6
  • Fix · GHSA-8gc5-j5rx-235r fast-xml-parser (npm) Fixed in 5.5.6 Advisory →
  • Fix · GHSA-8gc5-j5rx-235r fast-xml-parser (npm) Fixed in 4.5.5 Advisory →

Red Hat 12 advisories

  • RHSA-2026:51349 Released 2026-08-06 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:41944 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.20 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:41941 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.25 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
Show 9 more Red Hat advisories
  • RHSA-2026:40984 Released 2026-07-16 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20.15 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2026:17550 Released 2026-05-14 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.17.24 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.17 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:17549 Released 2026-05-14 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.16.26 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.16 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
  • RHSA-2026:17547 Released 2026-05-14 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.20 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:12279 Released 2026-04-30 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.15 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:12277 Released 2026-04-30 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20.10 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2026:9742 Released 2026-04-22 · Red Hat rating Critical
    Red Hat Developer Hub 1.8.6 release.
    • Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:7128 Released 2026-04-08 · Red Hat rating Important
    RHACS 4.9.5 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
  • RHSA-2026:7110 Released 2026-04-08 · Red Hat rating Important
    RHACS 4.8.10 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for Applications 8AffectedNo fix yet
Red Hat Developer Hub 1AffectedNo fix planned: Will not fix
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Self-service automation portal 2AffectedNo fix yet
Red Hat Advanced Cluster Security 4.8Fixed RHSA-2026:7110
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:7128
Red Hat Developer Hub 1.8Fixed RHSA-2026:9742
Red Hat Openshift Data Foundation 4.16Fixed RHSA-2026:17549
Red Hat Openshift Data Foundation 4.17Fixed RHSA-2026:17550
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2026:17547, RHSA-2026:41941
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:12279, RHSA-2026:41944
Red Hat Openshift Data Foundation 4.20Fixed RHSA-2026:12277, RHSA-2026:40984
Red Hat Satellite 6.18Fixed RHSA-2026:51349
Not affected: 10 products
  • Red Hat Advanced Cluster Security 4.8
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Developer Hub 1.8
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat Openshift Data Foundation 4.16
  • Red Hat Openshift Data Foundation 4.17
  • Red Hat Openshift Data Foundation 4.18
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Openshift Data Foundation 4.20
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33036
  2. 2026-10-03 Alias added: GHSA-8gc5-j5rx-235r
  3. 2026-10-25 EPSS moved to the below the 50th percentile
  4. 2026-10-27 Affected versions changed · Red Hat

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2026-20935 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names CVSS 3.1CRITICAL 9.3
  • TI-2026-20291 fast-xml-parser has RangeError DoS Numeric Entities Bug CVSS 3.1HIGH 7.5
  • TI-2026-30169 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters CVSS 3.1MEDIUM 6.1
  • TI-2026-25755 fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation CVSS 3.1MEDIUM 5.9
  • TI-2026-21247 fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) CVSS 3.1HIGH 7.5
  • TI-2024-27861 ReDOS at currency parsing fast-xml-parser CVSS 3.1HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences