Denial of Service Vulnerability in Fast XML Parser by Natural Intelligence

CVE-2026-33349

What is CVE-2026-33349?

The fast-xml-parser library improperly handles configuration limits for maxEntityCount and maxEntitySize due to JavaScript's treatment of truthy values. When developers set these limits to 0, intending to disallow entities or restrict their size, the checks are bypassed. An attacker can exploit this flaw by supplying malicious XML input, potentially leading to unbounded entity expansion and resulting in memory exhaustion, which can cause a denial of service for the application. This vulnerability has been addressed in version 5.5.7.

References