CVE-2026-33349: Fast-xml-parser DoS Vulnerability

CVE-2026-33349 Overview

CVE-2026-33349 is a Denial of Service vulnerability in fast-xml-parser, a popular JavaScript library that allows users to process XML from JS objects without C/C++ based libraries or callbacks. The vulnerability exists in the DocTypeReader component, which improperly validates entity limit configurations due to JavaScript's truthy/falsy evaluation behavior. When developers explicitly set maxEntityCount or maxEntitySize to 0 with the intention of completely disabling entity processing, the JavaScript truthy check causes these security controls to be bypassed entirely.

Critical Impact

An attacker who can supply XML input to affected applications can trigger unbounded entity expansion, leading to memory exhaustion and denial of service conditions.

Affected Products

• naturalintelligence fast-xml-parser versions 4.0.0-beta.3 through 5.5.6
• Applications using fast-xml-parser with maxEntityCount set to 0
• Applications using fast-xml-parser with maxEntitySize set to 0

Discovery Timeline

• 2026-03-24 - CVE CVE-2026-33349 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33349

Vulnerability Analysis

The vulnerability stems from improper input validation in the DocTypeReader component of fast-xml-parser. When processing XML documents containing entity declarations, the library checks the maxEntityCount and maxEntitySize configuration options to enforce limits on entity expansion. However, these checks use JavaScript's implicit boolean coercion rather than explicit numeric comparisons.

In JavaScript, the value 0 is considered "falsy," meaning it evaluates to false in boolean contexts. When a developer sets maxEntityCount: 0 or maxEntitySize: 0 intending to completely prohibit entity usage, the guard conditions evaluate the falsy 0 as if the configuration were undefined or not set. This causes the library to fall back to default behavior, allowing unlimited entity expansion instead of blocking all entities as intended.

This type of input validation flaw (CWE-1284) is particularly insidious because it subverts explicit security configurations. Developers who believe they have implemented the strictest possible security settings are actually left completely unprotected.

Root Cause

The root cause is the use of JavaScript truthy checks to evaluate numeric configuration values. Code patterns such as if (maxEntityCount) or maxEntityCount || defaultValue treat the explicit value 0 identically to undefined or null. The proper approach requires explicit comparison operators like if (maxEntityCount !== undefined && maxEntityCount !== null) or using typeof checks combined with numeric comparisons.

Attack Vector

The attack vector is network-based, requiring an attacker to supply malicious XML input to an application using the vulnerable library. The attack can be executed without authentication or user interaction, though it requires high attack complexity as the target application must be configured with entity limits explicitly set to 0.

An attacker would craft an XML document containing recursive or deeply nested entity definitions, commonly known as an XML bomb or billion laughs attack. When parsed by the vulnerable library, the entity expansion proceeds without bounds, rapidly consuming available memory until the application crashes or becomes unresponsive.

The vulnerability mechanism involves the DocTypeReader component's improper handling of zero-value configurations. When maxEntityCount or maxEntitySize is set to 0, the truthy check evaluates this as falsy, bypassing the intended restrictions and allowing unlimited entity expansion. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-33349

Indicators of Compromise

• Sudden spikes in memory consumption on servers processing XML input
• Application crashes or out-of-memory errors during XML parsing operations
• Slow response times or timeouts when handling XML requests
• Log entries showing extremely large entity expansion counts

Detection Strategies

• Audit application configurations for fast-xml-parser instances using maxEntityCount: 0 or maxEntitySize: 0
• Implement runtime monitoring for memory consumption during XML parsing operations
• Use dependency scanning tools to identify vulnerable versions of fast-xml-parser in your codebase
• Monitor for XML documents containing suspicious DOCTYPE declarations with entity definitions

Monitoring Recommendations

• Enable memory profiling for applications that process untrusted XML input
• Set up alerts for abnormal memory growth patterns during XML parsing
• Implement request logging to capture XML payloads for forensic analysis
• Configure application-level timeouts for XML processing operations

How to Mitigate CVE-2026-33349

Immediate Actions Required

• Upgrade fast-xml-parser to version 5.5.7 or later immediately
• Review all application configurations using fast-xml-parser to identify instances with zero-value entity limits
• As a temporary measure, set entity limits to 1 instead of 0 to enforce restrictions while awaiting patching
• Implement input validation to reject XML documents with DOCTYPE declarations from untrusted sources

Patch Information

The vulnerability has been patched in fast-xml-parser version 5.5.7. The fix ensures that zero values for maxEntityCount and maxEntitySize are properly respected as explicit limits rather than being bypassed by truthy evaluation. The patch is available in commit 239b64aa1fc5c5455ddebbbb54a187eb68c9fdb7. Users should update their package dependencies to incorporate this security fix.

Workarounds

• Set maxEntityCount and maxEntitySize to 1 instead of 0 as a temporary restriction
• Implement a pre-parser filter to strip or reject DOCTYPE declarations before passing XML to fast-xml-parser
• Use web application firewalls to block XML payloads containing entity definitions
• Consider disabling XML entity processing entirely at the application architecture level if not required

# Update fast-xml-parser to patched version
npm update fast-xml-parser@5.5.7

# Verify installed version
npm list fast-xml-parser