GHSA-JP2Q-39XQ-3W4G Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser

🗓️ 19 Mar 2026 19:13:13Reported by GoogleType

osv🔗 osv.dev👁 10 Views

Entity expansion limits set to zero can be bypassed in fast-xml-parser due to truthy checks, causing exhaustion.

Reporter	Title	Published	Views	Family All 55
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics Mobile is affected by multiple security vulnerabilties	22 May 202622:36	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge	18 Jul 202609:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses fast-xml-parser-5.5.5.tgz and requests-2.32.5-py3-none-any.whl, which are vulnerable to CVE-2026-33349 and CVE-2026-25645.	30 Apr 202611:40	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	1 Jun 202608:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to node module fast-xml-parser	22 May 202608:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Guardium Unified Discovery and Classification (GUDC) container images	17 Jul 202609:40	–	ibm
ATTACKERKB	CVE-2026-33349	24 Mar 202619:35	–	attackerkb
Chainguard	CVE-2026-33349 vulnerabilities	21 Mar 202601:17	–	cgr
Circl	CVE-2026-33349	19 Mar 202614:01	–	circl
CNNVD	fast-xml-parser 安全漏洞	24 Mar 202600:00	–	cnnvd

Source	Link
github	www.github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jp2q-39xq-3w4g
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-33349
github	www.github.com/NaturalIntelligence/fast-xml-parser/commit/239b64aa1fc5c5455ddebbbb54a187eb68c9fdb7
github	www.github.com/NaturalIntelligence/fast-xml-parser/commit/88d0936a23dabe51bfbf42255e2ce912dfee2221
github	www.github.com/NaturalIntelligence/fast-xml-parser

08 Apr 2026 22:32Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.15.9

EPSS0.00449