Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Validation of Specified Quantity in Input (CVE-2026-33349)

Summary There are vulnerabilities in fast-xml-parser-4.4.1.tgz, fast-xml-parser-5.2.5.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-33349. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-33349 DESCRIPTION: fast-xml-parser allows users to process X...

CVE-2026-33349: Improper Validation of Specified Quantity in Input

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a...

Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser

Summary The DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero bytes — the falsy nature of 0 in...