fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-

Description

The fix for CVE-2026-26278 added entity expansion limits (maxTotalExpansions, maxExpandedLength, maxEntityCount, maxEntitySize) to prevent XML entity expansion Denial of Service. However, these limits are only enforced for DOCTYPE-defined entities.

Recommendation

Update the fast-xml-parser package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 4.0.0-beta.3, < 4.5.5

  >= 5.0.0, < 5.5.6**

• Patched version(s): **4.5.5

  5.5.6**

References

• GHSA-8gc5-j5rx-235r
• CVE-2026-33036
• CWE-776
• CAPEC-310
• OWASP 2021-A5
• OWASP 2021-A6

Related Issues

• Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser - CVE-2026-33349
• fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) - CVE-2026-26278
• fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names - CVE-2026-25896
• fast-xml-parser has RangeError DoS Numeric Entities Bug - CVE-2026-25128

Tags:

npm

fast-xml-parser