Описание
Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser
Summary
The DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero bytes — the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, completely bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded entity expansion, leading to memory exhaustion and denial of service.
Details
The OptionsBuilder.js correctly preserves a user-supplied value of 0 using nullish coalescing (??):
However, DocTypeReader.js uses truthy evaluation to check these limits. Because 0 is falsy in JavaScript, the entire guard expression short-circuits to false, and the limit is never enforced:
The execution flow is:
- Developer configures
processEntities: { maxEntityCount: 0, maxEntitySize: 0 }intending to block all entity definitions. OptionsBuilder.normalizeProcessEntitiespreserves the0values via??(correct behavior).- Attacker supplies XML with a DOCTYPE containing many large entities.
DocTypeReader.readDocTypeevaluatesthis.options.maxEntityCount && ...— since0is falsy, the entire condition isfalse.DocTypeReader.readEntityExpevaluatesthis.options.maxEntitySize && ...— same result.- All entity count and size limits are bypassed; entities are parsed without restriction.
PoC
Expected output:
Impact
- Denial of Service: An attacker supplying crafted XML with thousands of large entity definitions can exhaust server memory in applications where the developer configured
maxEntityCount: 0ormaxEntitySize: 0, intending to prohibit entities entirely. - Security control bypass: Developers who explicitly set restrictive limits to
0receive no protection — the opposite of their intent. This creates a false sense of security. - Scope: Only applications that explicitly set these limits to
0are affected. The default configuration (maxEntityCount: 100,maxEntitySize: 10000) is not vulnerable. Theenabled: falseoption correctly disables entity processing entirely and is not affected.
Recommended Fix
Replace the truthy checks in DocTypeReader.js with explicit type checks that correctly treat 0 as a valid numeric limit:
Workaround
If you don't want to processed the entities, keep the processEntities flag to false instead of setting any limit to 0.
Ссылки
- https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jp2q-39xq-3w4g
- https://nvd.nist.gov/vuln/detail/CVE-2026-33349
- https://github.com/NaturalIntelligence/fast-xml-parser/commit/239b64aa1fc5c5455ddebbbb54a187eb68c9fdb7
- https://github.com/NaturalIntelligence/fast-xml-parser/commit/88d0936a23dabe51bfbf42255e2ce912dfee2221
Пакеты
fast-xml-parser
>= 4.0.0-beta.3, < 4.5.5
4.5.5
fast-xml-parser
>= 5.0.0, < 5.5.7
5.5.7
Связанные уязвимости
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero bytes — the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, completely bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded entity expansion, leading to memory exhaustion and denial of service. This issue has been patched in version 5.5.7.
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero bytes — the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, completely bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded entity expansion, leading to memory exhaustion and denial of service. This issue has been patched in version 5.5.7.
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero bytes — the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, completely bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded entity expansion, leading to memory exhaustion and denial of service. This issue has been patched in version 5.5.7.
fast-xml-parser allows users to process XML from JS object without C/C ...