{"action":"Upgrade fast-xml-parser to 4.5.5 or later.","affected":[{"fixed":"5.5.6","introduced":"5.0.0"},{"fixed":"4.5.5","introduced":"4.0.0-beta.3"}],"component":"fast-xml-parser","cve_ids":["CVE-2026-33036"],"ecosystem":"npm","epss":0.00612,"exploited":false,"fixed_versions":["5.5.6","4.5.5"],"ghsa_id":"GHSA-8gc5-j5rx-235r","id":"tcs_01M5KFCWAPNY9AQNDZJPYJVWPM","modified_at":"2026-09-10T03:50:38.199635360Z","published_at":"2026-03-17T19:45:41Z","references":["https://osv.dev/vulnerability/GHSA-8gc5-j5rx-235r","https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8gc5-j5rx-235r","https://nvd.nist.gov/vuln/detail/CVE-2026-33036","https://github.com/NaturalIntelligence/fast-xml-parser/commit/bd26122c838e6a55e7d7ac49b4ccc01a49999a01","https://github.com/NaturalIntelligence/fast-xml-parser","https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v4.5.5","https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.5.6"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-8gc5-j5rx-235r","url":"https://osv.dev/vulnerability/GHSA-8gc5-j5rx-235r"}],"summary":"fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)"}