fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero bytes — the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, completely bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded entity expansion, leading to memory exhaustion and denial of service. This issue has been patched in version 5.5.7.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks.
    From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript
    truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer
    explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero
    bytes — the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, completely
    bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded
    entity expansion, leading to memory exhaustion and denial of service. This issue has been patched in
    version 5.5.7. (CVE-2026-33349)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks.
    From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript     truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer     explicitly sets either limit to 0  intending to disallow all entities or restrict entity size to zero     bytes  the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, completely     bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded     entity expansion, leading to memory exhaustion and denial of service. This issue has been patched in     version 5.5.7. (CVE-2026-33349)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
465267	Echo: fast-xml-parser: security update to 4.5.5	Tenable Cloud Security	Echo Local Security Checks	Local	medium
465267	Echo: fast-xml-parser: security update to 4.5.5	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
304213	Linux Distros Unpatched Vulnerability : CVE-2026-33349	Nessus	Misc.	Local	medium
439047	SCA: security update for fast-xml-parser (GHSA-jp2q-39xq-3w4g)	Tenable Cloud Security	SCA Checks	Local	medium
439047	SCA: security update for fast-xml-parser (GHSA-jp2q-39xq-3w4g)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-33349

medium

Tenable Plugins

medium

medium

medium

medium

medium