CVE-2026-33036: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33036 is an XML entity expansion Denial of Service vulnerability in the fast-xml-parser npm library, representing an incomplete fix for the prior CVE-2026-26278. It affects versions 4.0.0-beta.3 through 5.5.5 (including 4.x betas up to 4.5.4 and all 5.x releases up to 5.5.5). The vulnerability was published on March 16, 2026, and patched in versions 5.5.6 and 4.5.5. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is classified as CWE-776 (Improper Restriction of Recursive Entity References in DTDs / XML Entity Expansion). In src/xmlparser/OrderedObjParser.js, the replaceEntitiesValue() function contains two separate entity replacement loops: one for DOCTYPE-defined entities (which correctly enforces entityExpansionCount and currentExpandedLength limits added by the CVE-2026-26278 fix), and a second lastEntities loop that handles numeric character references (&#NNN;, &#xHH;) and standard XML entities with no expansion counting whatsoever. An unauthenticated attacker can craft XML containing 1 million numeric entity references (e.g., A) to force approximately 147MB of memory allocation and heavy CPU usage, bypassing all configured limits such as maxTotalExpansions and maxExpandedLength — even when developers believe they have applied strict protections (GitHub Advisory, Patch Commit).

Successful exploitation results in a Denial of Service against any Node.js process that uses fast-xml-parser to parse untrusted XML input. An attacker can cause excessive memory allocation (147MB+ for 1M entity references), sustained CPU consumption during regex replacement, and potential process crash via out-of-memory (OOM) conditions. There is no confidentiality or integrity impact; the vulnerability is purely an availability risk. The danger is amplified because developers who explicitly configured strict entity expansion limits believe they are protected, while numeric entities silently bypass all of them (GitHub Advisory, Red Hat Bugzilla).

A self-contained JavaScript proof-of-concept (PoC) is publicly available in the GitHub Security Advisory, demonstrating the bypass with a simple script using A.repeat(100000) in an XML payload (GitHub Advisory). No authentication or user interaction is required, and the attack is executable over the network with low complexity. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.038% (0.000380), indicating a low current probability of active exploitation.

1. Identify a target: Find an application or API endpoint that accepts XML input and processes it using fast-xml-parser versions 4.0.0-beta.3 through 5.5.5 (e.g., a REST API accepting XML payloads, an XML file upload endpoint).
2. Craft a malicious XML payload: Construct an XML document containing a large number of numeric character references. For example, generate a payload with 1 million A (decimal) or A (hex) references:

   const xml = `<root>${'&#65;'.repeat(1000000)}</root>`;

3. Submit the payload: Send the crafted XML to the target endpoint via HTTP POST or any other supported input channel. No authentication is required.
4. Trigger resource exhaustion: The parser's replaceEntitiesValue() function processes the numeric entities through the uncounted lastEntities loop, allocating ~147MB of memory and consuming significant CPU — even if the application has configured strict limits like maxTotalExpansions: 10.
5. Achieve DoS: The Node.js process hosting the application crashes or becomes unresponsive due to OOM or CPU saturation, denying service to legitimate users (GitHub Advisory).

• Network: Unusually large XML payloads submitted to API endpoints (megabytes of repeated &#NNN; or &#xHH; patterns); high-frequency requests with XML content-type headers containing repetitive numeric entity sequences.
• Process: Node.js process memory usage spiking to 150MB+ unexpectedly; sustained high CPU utilization in the application process during XML parsing operations; process crashes or OOM-killer events in system logs.
• Logs: Application error logs showing out-of-memory exceptions or unhandled promise rejections during XML parsing; web server access logs showing large POST request bodies (>1MB) to XML-consuming endpoints from a single source IP.
• File System: Core dump files generated by a crashed Node.js process, potentially containing the malicious XML payload in memory artifacts.

Upgrade fast-xml-parser to version 5.5.6 or 4.5.5, which apply expansion counting to the lastEntities and HTML entities loops in replaceEntitiesValue() (v5.5.6 Release, Patch Commit). As a temporary workaround, set htmlEntities: false in the parser options to reduce (but not fully eliminate) the attack surface. Organizations using affected IBM products (including IBM API Connect, IBM App Connect Enterprise, IBM Maximo Application Suite, IBM watsonx Code Assistant, IBM CloudPak for AIOps, and others) should apply the respective IBM security bulletins as they become available (IBM API Connect, IBM App Connect).

The vulnerability was reported by researcher deprrous and analyzed by yuezk, with the advisory published by the maintainer amitguptagwl on March 16, 2026 (GitHub Advisory). Red Hat tracked the issue via Bugzilla with medium severity and assigned it to their Product Security DevOps Team, with 45 CC'd users indicating broad internal concern (Red Hat Bugzilla). IBM issued over a dozen security bulletins across its product portfolio acknowledging the vulnerability in downstream products. The vulnerability received coverage on security news aggregators and social media platforms including Mastodon and Bluesky, and was noted in the Secret CISO newsletter.