CVE-2026-33349: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33349 is an XML entity expansion denial-of-service vulnerability in the fast-xml-parser npm package, caused by JavaScript falsy evaluation incorrectly bypassing entity expansion limits when they are explicitly set to 0. It affects versions >= 4.0.0-beta.3 and < 4.5.5 (4.x branch) and >= 5.0.0 and < 5.5.7 (5.x branch). The vulnerability was published on March 19, 2026, and assigned a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory). Multiple IBM enterprise products that bundle fast-xml-parser are also affected, including IBM API Connect, IBM Maximo Application Suite, IBM App Connect Enterprise, IBM CloudPak for AIOps, IBM Guardium Data Security Center, and others (IBM Advisory).

The root cause is classified as CWE-1284 (Improper Validation of Specified Quantity in Input). In DocTypeReader.js, the entity count and size guard conditions use JavaScript truthy evaluation (this.options.maxEntityCount && and this.options.maxEntitySize &&). Because 0 is falsy in JavaScript, when a developer sets either limit to 0 intending to prohibit all entities, the guard short-circuits to false and the limit is never enforced — the opposite of the developer's intent. Meanwhile, OptionsBuilder.js correctly preserves the 0 value via nullish coalescing (??), so the misconfigured 0 is passed through to the broken check. The fix replaces truthy checks with explicit != null or typeof === 'number' checks, and additionally clamps all entity limits to a minimum of 1 via Math.max(1, ...) in OptionsBuilder.js (GitHub Advisory, Patch Commit).

Successful exploitation causes memory exhaustion and denial of service on the affected server. An unauthenticated remote attacker can craft XML input containing thousands of large entity definitions in a DOCTYPE block; because the limits are bypassed, the parser processes all entities without restriction, consuming unbounded server memory until the process crashes or becomes unresponsive. There is no confidentiality or integrity impact — the vulnerability is purely an availability concern affecting any service that parses attacker-controlled XML with the misconfigured fast-xml-parser settings (GitHub Advisory, Red Hat Bugzilla).

A public proof-of-concept (PoC) exploit is available in the official GitHub security advisory, consisting of a complete, runnable JavaScript snippet that demonstrates the bypass (GitHub Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.014% (0.000140), indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity because the attacker must identify an application that has explicitly misconfigured entity limits to 0, which is a non-default configuration.

1. Identify a vulnerable target: Locate a Node.js application that uses fast-xml-parser versions 4.0.0-beta.3 through 4.5.4 or 5.0.0 through 5.5.6, and that has been configured with processEntities: { maxEntityCount: 0 } or processEntities: { maxEntitySize: 0 } — a non-default, misconfigured setting.
2. Craft malicious XML: Construct an XML document with a DOCTYPE block containing a large number (e.g., 1,000+) of large entity definitions:

<!DOCTYPE foo [
  <!ENTITY e0 "AAAA...AAAA"> <!-- large value -->
  <!ENTITY e1 "AAAA...AAAA">
  ... (repeat 1000+ times)
]>
<root>&e0;</root>

3. Submit the payload: Send the crafted XML to any endpoint of the target application that accepts and parses XML input using the misconfigured fast-xml-parser instance (e.g., via HTTP POST to an API endpoint).
4. Trigger memory exhaustion: Because maxEntityCount: 0 and maxEntitySize: 0 are falsy in JavaScript, the guard conditions in DocTypeReader.js are bypassed, and all entity definitions are processed without restriction, exhausting server memory.
5. Achieve denial of service: The server process runs out of memory, causing it to crash or become unresponsive, resulting in service unavailability (GitHub Advisory).

• Network: Unusually large XML payloads (containing DOCTYPE blocks with many entity definitions) submitted to application endpoints that accept XML input; repeated requests with similar malformed XML structure from the same source IP.
• Logs: Application or Node.js process logs showing out-of-memory (OOM) errors or crashes; heap allocation failure messages in process logs; sudden process restarts in container or service orchestration logs (e.g., Kubernetes pod OOMKilled events).
• Process: Node.js process exhibiting rapidly increasing memory consumption when processing XML input; process termination signals (SIGKILL) from the OS due to memory limits being exceeded.
• File System: Core dump files generated by a crashed Node.js process in the application working directory (if core dumps are enabled).

Update fast-xml-parser to version 4.5.5 or later (for the 4.x branch) or 5.5.7 or later (for the 5.x branch) (GitHub Advisory). As an immediate workaround without upgrading, replace any configuration using maxEntityCount: 0 or maxEntitySize: 0 with either a positive numeric limit (e.g., the defaults maxEntityCount: 100, maxEntitySize: 10000) or set processEntities: { enabled: false } to completely disable entity processing. For affected IBM products (API Connect, Maximo Application Suite, App Connect Enterprise, CloudPak for AIOps, Guardium Data Security Center, Business Automation Manager Open Editions, QRadar Suite, and DevOps Solution Workbench), apply the product-specific security patches referenced in the respective IBM support bulletins (IBM Advisory).

The vulnerability was reported by security researcher tung2744 and published by the fast-xml-parser maintainer (amitguptagwl) on March 19, 2026 (GitHub Advisory). Red Hat tracked the issue via Bugzilla with medium severity, noting the impact on downstream packages (Red Hat Bugzilla). IBM issued multiple security bulletins across its product portfolio acknowledging the dependency on the vulnerable library and providing remediation guidance. No significant broader community controversy or social media discussion has been identified beyond standard vulnerability disclosure channels.