CVE-2026-53550
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability in js-yaml (YAML parser for JavaScript) before versions 4.2.0 and 3.15.0 allows a DoS attack via a crafted YAML document that causes quadratic time complexity during merge-key (<<) processing. Repeatedly using the same alias in a merge sequence leads to CPU exhaustion and blocks the Node.js event loop for seconds with a relatively small payload (tens of KB).
Risk Assessment
An attacker can remotely cause a denial of service (DoS) in Node.js applications using js-yaml to parse untrusted YAML data, blocking the server or worker process for seconds with minimal data input.
Recommendation
Immediately update js-yaml to version 4.2.0 or later (for the main branch) or 3.15.0 or later (for the 3.x branch). If an update is not possible, restrict processing of untrusted YAML documents.
Other vulnerabilities in js-yaml
See all- CVE-2026-73643High
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. Fixed in version 5.2.2.
- CVE-2026-59870Medium
A vulnerability in the js-yaml library (versions 5.0.0 through 5.2.0) causes excessive CPU consumption when parsing a crafted YAML document with the !!omap tag. The omapTag.addItem() function performs a linear duplicate-key scan on every insertion, resulting in O(n^2) computational complexity.
- CVE-2026-59869High
A vulnerability in the js-yaml library (JavaScript YAML parser and dumper) causes quadratic CPU time growth when processing YAML documents containing a chain of mappings with merge keys. The issue affects versions from 3.0.0 to 3.14.0 and from 4.0.0 to 4.2.0.
- CVE-2026-59868Medium
A vulnerability in the js-yaml library (versions 5.0.0 through 5.2.0) causes quadratic CPU time when parsing YAML documents with merge keys enabled. A chain of mappings where each entry merges the previous one leads to excessive CPU load.
Original NVD description (English source)
js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.