PT-2026-26757

Name of the Vulnerable Software and Affected Versions @dicebear/converter versions prior to 9.4.2 Description The ensureSize function in @dicebear/converter previously used a regex-based method to limit SVG width and height attributes to 2048px to prevent denial of service. This limitation could ...

0xuath-sdk-react (>=0.0.2, <=0.0.23), 1-test-gulp-1 (>=0.0.1, <=0.0.4) +15380 more potentially affected by CVE-2026-33349 via fast-xml-parser (>=4.0.0, <=5.5.6)

fast-xml-parser NPM version =4.0.0, =0.0.2, =0.0.1, =0.0.1, =1.0.0, =3.1.4, =0.1.0, =3.1.6, =0.1.0, =0.0.2, =4.11.2, =4.11.46 - @0610studio/rn-layout 0.0.1 - @0xflick/jest-dynamodb 4.0.1-pre.2 and more Source cves: CVE-2026-33349 Source advisory: SNYK:JS-FASTXMLPARSER-15699647...

5-ifc-check-cli (1.0.0), 7ghost (>=4.11.2, <=4.11.46) +4219 more potentially affected by CVE-2026-33349 via fast-xml-parser (>=4.0.0, <=4.5.4)

fast-xml-parser NPM version =4.0.0, =4.11.2, =0.1.1, =0.0.2, =1.0.1, =1.0.0, =1.52.0, =0.0.1, =1.0.0, =0.0.1, =1.1.2 and more Source cves: CVE-2026-33349 Source advisory: OSV:GHSA-JP2Q-39XQ-3W4G...

GHSA-JP2Q-39XQ-3W4G Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser

Summary The DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero bytes — the falsy nature of 0 in...

Improper Validation of Specified Quantity in Input

Overview org.webjars.npm:fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the DocTypeReader component when the maxEntityCount or maxEntitySize configurati...

Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser

Summary The DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero bytes — the falsy nature of 0 in...

Improper Validation of Specified Quantity in Input

Overview fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the DocTypeReader component when the maxEntityCount or maxEntitySize configuration options are...

@activepieces/piece-amazon-s3 (>=0.5.4, <=0.6.4), @activepieces/piece-amazon-ses (>=0.0.1, <=0.1.4) +1160 more potentially affected by CVE-2026-33349 via fast-xml-parser (>=5.0.1, <=5.5.6)

fast-xml-parser NPM version =5.0.1, =0.5.4, =0.0.1, =0.2.0, =0.1.3, =0.5.3, =0.2.1, =0.0.4, =13.1.4, =1.0.0, =1.9.12, =1.0.3, =1.1.31, =1.0.0, =1.5.0 and more Source cves: CVE-2026-33349 Source advisory: OSV:GHSA-JP2Q-39XQ-3W4G...

com.codbex.atlas:codbex-atlas-application (>=2.62.0, <=2.120.0), com.codbex.gaia:codbex-gaia-application (>=2.61.0, <=2.104.0) +25 more potentially affected by CVE-2026-33349 via org.webjars.npm:fast-xml-parser (>=4.5.3, <=5.8.0)

org.webjars.npm:fast-xml-parser MAVEN version =4.5.3, =2.62.0, =2.61.0, =2.52.0, =2.52.0, =2.51.0, =2.51.0, =3.6.0, =2.50.0, =5.0.0, =5.0.0, =11.58.0, =12.2.0, =11.58.0, =11.58.0, =14.19.0, =14.28.0 and more Source cves: CVE-2026-33349 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15699648...

PT-2026-26487

Name of the Vulnerable Software and Affected Versions fast-xml-parser versions 4.0.0-beta.3 through 5.5.6 Description The DocTypeReader in fast-xml-parser incorrectly uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer sets either limi...

XML Entity Expansion

Overview fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to XML Entity Expansion in the replaceEntitiesValue function, which doesn't protect unlimited expansion of numeric entities the way it does DOCTYPE data ...

XML Entity Expansion

Overview org.webjars.npm:fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to XML Entity Expansion in the replaceEntitiesValue function, which doesn't protect unlimited expansion of numeric entities the way it do...

@activepieces/piece-amazon-s3 (>=0.5.4, <=0.6.4), @activepieces/piece-amazon-ses (>=0.0.1, <=0.1.4) +1157 more potentially affected by CVE-2026-33036 via fast-xml-parser (>=5.0.1, <=5.5.5)

fast-xml-parser NPM version =5.0.1, =0.5.4, =0.0.1, =0.1.3, =0.5.3, =0.2.1, =13.1.4, =1.0.0, =1.9.12, =1.0.3, =1.1.31, =1.0.0, =1.0.0, =1.7.16, =1.10.0 and more Source cves: CVE-2026-33036 Source advisory: OSV:GHSA-8GC5-J5RX-235R...

5-ifc-check-cli (1.0.0), 7ghost (>=4.11.2, <=4.11.46) +4219 more potentially affected by CVE-2026-33036 via fast-xml-parser (>=4.0.0, <=4.5.4)

fast-xml-parser NPM version =4.0.0, =4.11.2, =0.1.1, =0.0.2, =1.0.1, =1.0.0, =1.52.0, =0.0.1, =1.0.0, =0.0.1, =1.1.2 and more Source cves: CVE-2026-33036 Source advisory: OSV:GHSA-8GC5-J5RX-235R...

GHSA-8GC5-J5RX-235R fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

Summary The fix for CVE-2026-26278 added entity expansion limits maxTotalExpansions, maxExpandedLength, maxEntityCount, maxEntitySize to prevent XML entity expansion Denial of Service. However, these limits are only enforced for DOCTYPE-defined entities. Numeric character references &NNN; and &xH...

fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

Summary The fix for CVE-2026-26278 added entity expansion limits maxTotalExpansions, maxExpandedLength, maxEntityCount, maxEntitySize to prevent XML entity expansion Denial of Service. However, these limits are only enforced for DOCTYPE-defined entities. Numeric character references &NNN; and &xH...

com.codbex.atlas:codbex-atlas-application (>=2.62.0, <=2.120.0), com.codbex.gaia:codbex-gaia-application (>=2.61.0, <=2.104.0) +25 more potentially affected by CVE-2026-26278 +1 more via org.webjars.npm:fast-xml-parser (>=4.5.3, <=5.8.0)

org.webjars.npm:fast-xml-parser MAVEN version =4.5.3, =2.62.0, =2.61.0, =2.52.0, =2.52.0, =2.51.0, =2.51.0, =3.6.0, =2.50.0, =5.0.0, =5.0.0, =11.58.0, =12.2.0, =11.58.0, =11.58.0, =14.19.0, =14.28.0 and more Source cves: CVE-2026-26278, CVE-2026-33036 Source advisory:...

0xuath-sdk-react (>=0.0.2, <=0.0.23), 1-test-gulp-1 (>=0.0.1, <=0.0.4) +15378 more potentially affected by CVE-2026-26278 +1 more via fast-xml-parser (>=4.0.0, <=5.5.5)

fast-xml-parser NPM version =4.0.0, =0.0.2, =0.0.1, =0.0.1, =1.0.0, =3.1.4, =0.1.0, =3.1.6, =0.1.0, =0.0.2, =4.11.2, =4.11.46 - @0610studio/rn-layout 0.0.1 - @0xflick/jest-dynamodb 4.0.1-pre.2 and more Source cves: CVE-2026-26278, CVE-2026-33036 Source advisory: SNYK:JS-FASTXMLPARSER-15677840...

PT-2026-25995

Name of the Vulnerable Software and Affected Versions fast-xml-parser versions 4.0.0-beta.3 through 5.5.5 Description fast-xml-parser allows users to process XML from JavaScript objects without relying on C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass tha...

Stack Overflow

fast-xml-parser is vulnerable to stack overflow vulnerability. The vulnerability is due to improper handling in the XML builder when preserveOrder:true is enabled, which allows an attacker to trigger a stack overflow and crash the application by providing crafted input data...