CVE-2026-53550
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk17th percentile — higher than 17% of all known CVEs
Summary
A vulnerability in js-yaml prior to versions 4.2.0 and 3.15.0 allows a DoS attack via a crafted YAML document with a repeatedly aliased merge key (<<). This causes quadratic parse-time complexity, potentially blocking the Node.js event loop for seconds with a relatively small payload (tens of KB).
Risk Assessment
An attacker can remotely cause a denial of service (DoS) of a Node.js application using js-yaml to parse untrusted YAML data, blocking its operation for seconds even with a small payload.
Recommendation
Immediately update js-yaml to version 4.2.0 or later (for 4.x branch) or 3.15.0 or later (for 3.x branch).
Original NVD description (English source)
js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.