{"action":"Upgrade fast-xml-parser to 4.5.5 or later.","affected":[{"fixed":"4.5.5","introduced":"4.0.0-beta.3"},{"fixed":"5.5.7","introduced":"5.0.0"}],"component":"fast-xml-parser","cve_ids":["CVE-2026-33349"],"ecosystem":"npm","epss":0.00467,"exploited":false,"fixed_versions":["4.5.5","5.5.7"],"ghsa_id":"GHSA-jp2q-39xq-3w4g","id":"tcs_01M5KFYFPNFKMWW56765HW94NH","modified_at":"2026-09-10T03:50:39.873055407Z","published_at":"2026-03-19T19:13:13Z","references":["https://osv.dev/vulnerability/GHSA-jp2q-39xq-3w4g","https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jp2q-39xq-3w4g","https://nvd.nist.gov/vuln/detail/CVE-2026-33349","https://github.com/NaturalIntelligence/fast-xml-parser/commit/239b64aa1fc5c5455ddebbbb54a187eb68c9fdb7","https://github.com/NaturalIntelligence/fast-xml-parser/commit/88d0936a23dabe51bfbf42255e2ce912dfee2221","https://github.com/NaturalIntelligence/fast-xml-parser"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-jp2q-39xq-3w4g","url":"https://osv.dev/vulnerability/GHSA-jp2q-39xq-3w4g"}],"summary":"Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser"}