Skip to content
Fencer Vulns
high 7.5

CVE-2026-33036 json

fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

published 2026-03-17 7 mo ago modified 2026-09-10 1 mo ago also GHSA-8gc5-j5rx-235r , EUVD-2026-13573

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits
0
none known

Summary

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, &#xHH;) and standard XML entities completely evade the entity expansion limits (e.g., maxTotalExpansions, maxExpandedLength) added to fix CVE-2026-26278, enabling XML entity expansion Denial of Service. The root cause is that replaceEntitiesValue() in OrderedObjParser.js only enforces expansion counting on DOCTYPE-defined entities while the lastEntities loop handling numeric/standard entities performs no counting at all. An attacker supplying 1M numeric entity references like A can force ~147MB of memory allocation and heavy CPU usage, potentially crashing the process—even when developers have configured strict limits. This issue has been fixed in version 5.5.6.

Patch / fix

  • npm fast-xml-parser 4.5.5, 5.5.6
  • naturalintelligence fast-xml-parser 5.5.6
  • velociraptor openSUSE Tumbleweed 0.7.0.4.git185.a5708584-2.1
  • heroic-games-launcher openSUSE Tumbleweed 2.20.1-4.1

opensuse advisories openSUSE-SU-2026:11126-1openSUSE-SU-2026:10462-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-33036 updated cvss 7.5

fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass

  • Red Hat Migration Toolkit for Applications 8 mta/mta-ui-rhel9
    affected: workaround, no fix available
  • Red Hat Developer Hub 1 rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal
    affected: workaround, no fix available
  • Red Hat Advanced Cluster Security 4.8 advanced-cluster-security 1775594119
    fixed: vendor fix RHSA-2026:7110
  • Red Hat Advanced Cluster Security 4.9 advanced-cluster-security 1775594284
    fixed: vendor fix RHSA-2026:7128
  • Red Hat Developer Hub 1.8 rhdh 1776784286
    fixed: vendor fix RHSA-2026:9742
  • Red Hat Openshift Data Foundation 4.16 odf4 1778076673, odf4 1778076741, odf4 1778076861, odf4 1778076916, odf4 1778077002, odf4 1778077066, +12 more
    fixed: vendor fix RHSA-2026:17549
  • Red Hat Openshift Data Foundation 4.17 odf4 1778049298, odf4 1778049594, odf4 1778049745, odf4 1778049753, odf4 1778049818, odf4 1778049878, +13 more
    fixed: vendor fix RHSA-2026:17550
show 8 more
  • Red Hat Openshift Data Foundation 4.18 odf4 1778044961, odf4 1778045210, odf4 1778045359, odf4 1778045374, odf4 1778045472, odf4 1778045524, +32 more
    fixed: vendor fix RHSA-2026:41941
  • Red Hat Openshift Data Foundation 4.19 odf4 1776079019, odf4 1776079295, odf4 1776079774, odf4 1776706744, odf4 1776707205, odf4 1776707231, +33 more
    fixed: vendor fix RHSA-2026:41944
  • Red Hat Openshift Data Foundation 4.20 odf4 1775822432, odf4 1775822689, odf4 1775823207, odf4 1776403457, odf4 1776403991, odf4 1776404009, +37 more
    fixed: vendor fix RHSA-2026:12277
  • Red Hat Satellite 6.18 satellite/iop-host-inventory-frontend-rhel9 1785922764
    fixed: vendor fix RHSA-2026:51349
  • Red Hat Advanced Cluster Security 4.8 advanced-cluster-security 1774163438, advanced-cluster-security 1774294180, advanced-cluster-security 1775594119 Red Hat Advanced Cluster Security 4.9 advanced-cluster-security 1774260292, advanced-cluster-security 1774294136, advanced-cluster-security 1775594284 Red Hat Developer Hub 1.8 rhdh 1776783947, rhdh 1776787729
    not affected: vulnerable code not present
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9
    not affected: component not present
  • Red Hat Openshift Data Foundation 4.16 odf4 1778079375, odf4 1778079383, odf4 1778079392, odf4 1778079393, odf4 1778079401, odf4 1778079403, +4 more Red Hat Openshift Data Foundation 4.17 odf4 1778061396, odf4 1778061397, odf4 1778061401, odf4 1778061412, odf4 1778061413, odf4 1778061414, +5 more Red Hat Openshift Data Foundation 4.18 odf4 1778047963, odf4 1778047967, odf4 1778047972, odf4 1778047973, odf4 1778047978, odf4 1778047981, +18 more Red Hat Openshift Data Foundation 4.19 odf4 1776710227, odf4 1776710229, odf4 1776710244, odf4 1776710246, odf4 1776710257, odf4 1776710261, +19 more Red Hat Openshift Data Foundation 4.20 odf4 1776421513, odf4 1776421515, odf4 1776421520, odf4 1776421524, odf4 1776421528, odf4 1776421532, +21 more
    not affected: vulnerable code not present
  • Red Hat Satellite 6 satellite/iop-vulnerability-frontend-rhel9
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

0.61% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8gc5-j5rx-235r referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm fast-xml-parser
>=5.0.0, <5.5.6
>=4.0.0-beta.3, <4.5.5
5.5.6
4.5.5

Affected products

  • NaturalIntelligence fast-xml-parser

Classification

Weakness
  • CWE-776 Improper Restriction of Recursive Entity References in DTDs

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.