Description
The DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits.
Recommendation
Update the fast-xml-parser package to the latest compatible version. Followings are version details:
Affected version(s): **>= 5.0.0, < 5.5.7 >= 4.0.0-beta.3, < 4.5.5** Patched version(s): **5.5.7 4.5.5**
References
Could your website be exposed too?
SmartScanner can check your website for Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser and gives you actionable findings to investigate.
Start a free scanRelated Issues
- fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026- - CVE-2026-33036
- fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits - CVE-2026-73569
- fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) - CVE-2026-26278
- fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names - CVE-2026-25896
You might also like:
See something that needs correcting? Let us knowUpdated April 08, 2026