fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

🗓️ 17 Mar 2026 19:45:41Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 13 Views

Numeric character references bypass expansion limits in fast-xml-parser, CVE not fully fixed.

Reporter	Title	Published	Views	Family All 122
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics Mobile is affected by multiple security vulnerabilties	22 May 202622:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty	28 Apr 202613:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple node modules.	21 Apr 202618:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem	9 Apr 202610:57	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	29 Apr 202613:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple node modules.	27 Mar 202616:53	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in fast-xml-parser affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	22 Jun 202613:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Watsonx BI Assistant for CP4D	27 Apr 202616:13	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in fast-xml affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	22 Jun 202613:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service due to vulnerabilities in Node.js dependencies	7 Apr 202616:09	–	ibm

Vulners

Node

naturalintelligence fast-xml-parserRange4.0.0-beta.3–4.5.5npm

OR

naturalintelligence fast-xml-parserRange5.0.0–5.5.6npm

Source	Link
github	www.github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8gc5-j5rx-235r
github	www.github.com/NaturalIntelligence/fast-xml-parser/commit/bd26122c838e6a55e7d7ac49b4ccc01a49999a01
github	www.github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.5.6
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-33036
github	www.github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v4.5.5
github	www.github.com/advisories/GHSA-8gc5-j5rx-235r

25 Mar 2026 14:31Current

6Medium risk

Vulners AI Score6

CVSS 3.17.5

EPSS0.00589

SSVC

numeric character references entity expansion limits CVE-2026-26278 doctype entities fast-xml-parser incomplete fix