Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser

🗓️ 19 Mar 2026 19:13:13Reported by GitHub Advisory DatabaseType

Zero values for entity limits are ignored by truthy checks in DocTypeReader, risking unbounded entity expansion.

Reporter	Title	Published	Views	Family All 47
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics Mobile is affected by multiple security vulnerabilties	22 May 202622:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses fast-xml-parser-5.5.5.tgz and requests-2.32.5-py3-none-any.whl, which are vulnerable to CVE-2026-33349 and CVE-2026-25645.	30 Apr 202611:40	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	1 Jun 202608:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to node module fast-xml-parser	22 May 202608:32	–	ibm
ATTACKERKB	CVE-2026-33349	24 Mar 202619:35	–	attackerkb
Chainguard	CVE-2026-33349 vulnerabilities	21 Mar 202601:17	–	cgr
Circl	CVE-2026-33349	19 Mar 202614:01	–	circl
CNNVD	fast-xml-parser 安全漏洞	24 Mar 202600:00	–	cnnvd
CVE	CVE-2026-33349	24 Mar 202619:35	–	cve
Cvelist	CVE-2026-33349 fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation	24 Mar 202619:35	–	cvelist

Vulners

Node

Source	Link
github	www.github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jp2q-39xq-3w4g
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-33349
github	www.github.com/NaturalIntelligence/fast-xml-parser/commit/239b64aa1fc5c5455ddebbbb54a187eb68c9fdb7
github	www.github.com/NaturalIntelligence/fast-xml-parser/commit/88d0936a23dabe51bfbf42255e2ce912dfee2221
github	www.github.com/advisories/GHSA-jp2q-39xq-3w4g

08 Apr 2026 22:27Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.15.9

EPSS0.00449

SSVC