CVE-2026-33036: XML DoS in fast-xml-parser

An attacker can exploit CVE-2026-33036 by crafting a malicious XML document containing a large number of numeric character references (e.g., &#NNN; and &#xHH;). Because these references are processed through a separate code path that lacks expansion limits, the parser will attempt to expand them all, consuming excessive memory. This can lead to a denial of service, crashing the application or exhausting system resources. The blast radius depends on the application's resource limits and the attacker's ability to send the malicious XML. This bypass effectively negates the protections implemented in CVE-2026-26278, making applications vulnerable even if they applied that previous patch.

1. Reserved2026-03-17
2. Published2026-03-17
3. Modified2026-03-25
4. EPSS updated2026-03-27

The primary mitigation for CVE-2026-33036 is to upgrade to fast-xml-parser version 5.5.6 or later, which includes the necessary fix to enforce expansion limits on numeric character references. If upgrading is not immediately feasible, consider implementing input validation to restrict the use of numeric character references in XML documents processed by the application. Web application firewalls (WAFs) might be configured to block XML requests containing excessive numeric character references, but this is not a guaranteed solution. There are no specific rollback steps beyond reverting to a previous version of fast-xml-parser prior to the introduction of the flawed entity expansion logic. After upgrading, confirm the fix by attempting to parse a large XML document containing numerous numeric character references; the parser should now enforce expansion limits and not consume excessive memory.

Last updated

5.8.0recently