Unrated

DEBIAN-CVE-2026-33349

Type: advisorySource: OSV1 source record

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero bytes — the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, completely bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded entity expansion, leading to memory exhaustion and denial of service. This issue has been patched in version 5.5.7.

Announced 24 Mar 2026Source revision 1

Original source ↗

DEBIAN-CVE-2026-33349

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-33349

node-webfont

Source reference: /affected/0/package/name

Affected versions: 11.4.0+dfsg2+~cs35.7.26-10
Source reference: /affected/0/versions
11.4.0+dfsg2+~cs35.7.26-11
Source reference: /affected/0/versions
11.4.0+dfsg2+~cs35.7.26-12
Source reference: /affected/0/versions
11.4.0+dfsg2+~cs35.7.26-13
Source reference: /affected/0/versions
11.4.0+dfsg2+~cs35.7.26-14
Source reference: /affected/0/versions
11.4.0+dfsg2+~cs35.7.26-15
Source reference: /affected/0/versions
11.4.0+dfsg2+~cs35.7.26-16
Source reference: /affected/0/versions
11.4.0+dfsg2+~cs35.7.26-18
Source reference: /affected/0/versions
11.4.0+dfsg2+~cs35.7.26-19
Source reference: /affected/0/versions
11.4.0+dfsg2+~cs35.7.26-20
Source reference: /affected/0/versions
11.4.0+dfsg2+~cs35.7.26-21
Source reference: /affected/0/versions
11.4.0+dfsg2+~cs35.7.26-7
Source reference: /affected/0/versions
11.4.0+dfsg2+~cs35.7.26-8
Source reference: /affected/0/versions
11.4.0+dfsg2+~cs35.7.26-9
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

node-webfont

Source reference: /affected/1/package/name

Affected versions: 11.4.0+dfsg2+~cs35.7.26-13
Source reference: /affected/1/versions
11.4.0+dfsg2+~cs35.7.26-14
Source reference: /affected/1/versions
11.4.0+dfsg2+~cs35.7.26-15
Source reference: /affected/1/versions
11.4.0+dfsg2+~cs35.7.26-16
Source reference: /affected/1/versions
11.4.0+dfsg2+~cs35.7.26-18
Source reference: /affected/1/versions
11.4.0+dfsg2+~cs35.7.26-19
Source reference: /affected/1/versions
11.4.0+dfsg2+~cs35.7.26-20
Source reference: /affected/1/versions
11.4.0+dfsg2+~cs35.7.26-21
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

node-webfont

Source reference: /affected/2/package/name

Affected versions: 11.4.0+dfsg2+~cs35.7.26-13
Source reference: /affected/2/versions
11.4.0+dfsg2+~cs35.7.26-14
Source reference: /affected/2/versions
11.4.0+dfsg2+~cs35.7.26-15
Source reference: /affected/2/versions
11.4.0+dfsg2+~cs35.7.26-16
Source reference: /affected/2/versions
11.4.0+dfsg2+~cs35.7.26-18
Source reference: /affected/2/versions
11.4.0+dfsg2+~cs35.7.26-19
Source reference: /affected/2/versions
11.4.0+dfsg2+~cs35.7.26-20
Source reference: /affected/2/versions
11.4.0+dfsg2+~cs35.7.26-21
Source reference: /affected/2/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "node-webfont",
      "purl": "pkg:deb/debian/node-webfont?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "11.4.0+dfsg2+~cs35.7.26-10",
      "11.4.0+dfsg2+~cs35.7.26-11",
      "11.4.0+dfsg2+~cs35.7.26-12",
      "11.4.0+dfsg2+~cs35.7.26-13",
      "11.4.0+dfsg2+~cs35.7.26-14",
      "11.4.0+dfsg2+~cs35.7.26-15",
      "11.4.0+dfsg2+~cs35.7.26-16",
      "11.4.0+dfsg2+~cs35.7.26-18",
      "11.4.0+dfsg2+~cs35.7.26-19",
      "11.4.0+dfsg2+~cs35.7.26-20",
      "11.4.0+dfsg2+~cs35.7.26-21",
      "11.4.0+dfsg2+~cs35.7.26-7",
      "11.4.0+dfsg2+~cs35.7.26-8",
      "11.4.0+dfsg2+~cs35.7.26-9"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33349.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "node-webfont",
      "purl": "pkg:deb/debian/node-webfont?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "11.4.0+dfsg2+~cs35.7.26-13",
      "11.4.0+dfsg2+~cs35.7.26-14",
      "11.4.0+dfsg2+~cs35.7.26-15",
      "11.4.0+dfsg2+~cs35.7.26-16",
      "11.4.0+dfsg2+~cs35.7.26-18",
      "11.4.0+dfsg2+~cs35.7.26-19",
      "11.4.0+dfsg2+~cs35.7.26-20",
      "11.4.0+dfsg2+~cs35.7.26-21"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33349.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "node-webfont",
      "purl": "pkg:deb/debian/node-webfont?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "11.4.0+dfsg2+~cs35.7.26-13",
      "11.4.0+dfsg2+~cs35.7.26-14",
      "11.4.0+dfsg2+~cs35.7.26-15",
      "11.4.0+dfsg2+~cs35.7.26-16",
      "11.4.0+dfsg2+~cs35.7.26-18",
      "11.4.0+dfsg2+~cs35.7.26-19",
      "11.4.0+dfsg2+~cs35.7.26-20",
      "11.4.0+dfsg2+~cs35.7.26-21"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33349.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #56411 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 16:36:07 GMT
Publisher date: Tue, 24 Mar 2026 20:16:29 GMT

Read the original announcement