fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation
Priority MEDIUM 60CWE-1284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 fixed, 9 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero bytes — the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, completely bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded entity expansion, leading to memory exhaustion and denial of service. This issue has been patched in version 5.5.7.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00467 40th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial fast-xml-parser (NaturalIntelligence): 5.5.7fast-xml-parser (npm): 4.5.5, 5.5.7Red Hat: 2 advisoriesRed Hat: 2 fixed, 9 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NaturalIntelligence | fast-xml-parser | 4.0.0-beta.3 to before 5.5.7 | 5.5.7 | Patch available | CNA |
| — | fast-xml-parser (npm) | 4.0.0-beta.3 to before 4.5.5 | 4.5.5 | Patch available | GHSA-jp2q-39xq-3w4g |
| — | fast-xml-parser (npm) | 5.0.0 to before 5.5.7 | 5.5.7 | Patch available | GHSA-jp2q-39xq-3w4g |
- fast-xml-parser VendorNaturalIntelligence Affected 4.0.0-beta.3 to before 5.5.7 Fixed in 5.5.7 Patch available CNA
- fast-xml-parser (npm) Vendor— Affected 4.0.0-beta.3 to before 4.5.5 Fixed in 4.5.5 Patch available GHSA-jp2q-39xq-3w4g
- fast-xml-parser (npm) Vendor— Affected 5.0.0 to before 5.5.7 Fixed in 5.5.7 Patch available GHSA-jp2q-39xq-3w4g
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:* | 4.0.1 to before 4.5.5; 5.0.0 to before 5.5.7 | Vulnerable | NaturalIntelligence |
| cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:-:*:*:*:*:*:* | 4.0.0 | Vulnerable | NaturalIntelligence |
| cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta3:*:*:*:*:*:* | 4.0.0 beta3 | Vulnerable | NaturalIntelligence |
| cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta4:*:*:*:*:*:* | 4.0.0 beta4 | Vulnerable | NaturalIntelligence |
| cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta5:*:*:*:*:*:* | 4.0.0 beta5 | Vulnerable | NaturalIntelligence |
| cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta6:*:*:*:*:*:* | 4.0.0 beta6 | Vulnerable | NaturalIntelligence |
| cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta7:*:*:*:*:*:* | 4.0.0 beta7 | Vulnerable | NaturalIntelligence |
| cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta8:*:*:*:*:*:* | 4.0.0 beta8 | Vulnerable | NaturalIntelligence |
- cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:* Versions 4.0.1 to before 4.5.5; 5.0.0 to before 5.5.7 Vulnerable ·NaturalIntelligence
- cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:-:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·NaturalIntelligence
- cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta3:*:*:*:*:*:* Versions 4.0.0 beta3 Vulnerable ·NaturalIntelligence
- cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta4:*:*:*:*:*:* Versions 4.0.0 beta4 Vulnerable ·NaturalIntelligence
- cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta5:*:*:*:*:*:* Versions 4.0.0 beta5 Vulnerable ·NaturalIntelligence
- cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta6:*:*:*:*:*:* Versions 4.0.0 beta6 Vulnerable ·NaturalIntelligence
- cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta7:*:*:*:*:*:* Versions 4.0.0 beta7 Vulnerable ·NaturalIntelligence
- cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta8:*:*:*:*:*:* Versions 4.0.0 beta8 Vulnerable ·NaturalIntelligence
Remediation
- Fix · CNA fast-xml-parser (NaturalIntelligence) Fixed in 5.5.7
- Fix · GHSA-jp2q-39xq-3w4g fast-xml-parser (npm) Fixed in 4.5.5 Advisory →
- Fix · GHSA-jp2q-39xq-3w4g fast-xml-parser (npm) Fixed in 5.5.7 Advisory →
Red Hat 2 advisories
- RHSA-2026:56431 Released 2026-08-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
- RHSA-2026:24841 Released 2026-06-09 · Red Hat rating ModerateRed Hat Developer Hub 1.10.0 release.
- Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Applications 8 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Self-service automation portal 2 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1.10 | Fixed | RHSA-2026:24841 |
| Red Hat Openshift Data Foundation 4.18 | Fixed | RHSA-2026:56431 |
Not affected: 2 products
- Red Hat Developer Hub 1.10
- Red Hat Openshift Data Foundation 4.18
Timeline
- 2026-10-02 Threatist record created from CVE-2026-33349
- 2026-10-03 Alias added: GHSA-jp2q-39xq-3w4g
- 2026-10-27 Affected versions changed · Red Hat
References
Exploit 1
More NaturalIntelligence Fast-xml-parser vulnerabilities
- TI-2026-20935 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names CVSS 3.1CRITICAL 9.3
- TI-2026-25482 fast-xml-parser affected by numeric entity expansion bypassing all entity expansion… CVSS 3.1HIGH 7.5
- TI-2026-20291 fast-xml-parser has RangeError DoS Numeric Entities Bug CVSS 3.1HIGH 7.5
- TI-2026-30169 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters CVSS 3.1MEDIUM 6.1
- TI-2026-21247 fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) CVSS 3.1HIGH 7.5
- TI-2024-27861 ReDOS at currency parsing fast-xml-parser CVSS 3.1HIGH 7.5
Sources
- CVE-2026-33349 · CVE Program
- CVE-2026-33349 · NVD
- FIRST EPSS
- GHSA-jp2q-39xq-3w4g · GitHub Advisory Database · CC BY 4.0
- CVE-2026-33349 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences