CVE-2026-53550

js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:nodeca:js-yaml::::::node.js::*
	cpe:2.3:a:nodeca:js-yaml::::::node.js::*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) js-yaml es un analizador y volcador YAML de JavaScript. Antes de 4.2.0 y 3.15.0, un documento YAML manipulado puede desencadenar un agotamiento algorítmico de la CPU en el procesamiento de claves de fusión (<<) de js-yaml al repetir el mismo alias muchas veces en una secuencia de fusión. Esto causa un comportamiento cuadrático en tiempo de análisis en relación con el tamaño de la entrada y puede bloquear un worker/bucle de eventos de Node.js durante segundos con una carga útil relativamente pequeña (decenas de KB), resultando en denegación de servicio. El problema está en el manejo de fusiones dentro de lib/loader.js. Esta vulnerabilidad está corregida en 4.2.0 y 3.15.0.

Information

Published : 2026-06-22 16:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-53550

Mitre link : CVE-2026-53550

CVE.ORG link : CVE-2026-53550

JSON object : View

Products Affected

nodeca

js-yaml

CWE

CWE-407

Inefficient Algorithmic Complexity

{"id": "CVE-2026-53550", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53550", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T16:05:40.611324Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nodeca", "product": "js-yaml", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.2.0"}, {"status": "affected", "version": "< 3.15.0"}]}]}], "published": "2026-06-22T16:16:38.447", "references": [{"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-407"}]}], "descriptions": [{"lang": "en", "value": "js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0."}, {"lang": "es", "value": "js-yaml es un analizador y volcador YAML de JavaScript. Antes de 4.2.0 y 3.15.0, un documento YAML manipulado puede desencadenar un agotamiento algor\u00edtmico de la CPU en el procesamiento de claves de fusi\u00f3n (<<) de js-yaml al repetir el mismo alias muchas veces en una secuencia de fusi\u00f3n. Esto causa un comportamiento cuadr\u00e1tico en tiempo de an\u00e1lisis en relaci\u00f3n con el tama\u00f1o de la entrada y puede bloquear un worker/bucle de eventos de Node.js durante segundos con una carga \u00fatil relativamente peque\u00f1a (decenas de KB), resultando en denegaci\u00f3n de servicio. El problema est\u00e1 en el manejo de fusiones dentro de lib/loader.js. Esta vulnerabilidad est\u00e1 corregida en 4.2.0 y 3.15.0."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "6BA37F36-3871-48AF-97FA-C3EFA44746C9", "versionEndExcluding": "3.15.0"}, {"criteria": "cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "0CB244DD-6149-4E5B-A950-10C4FE3484CD", "versionEndExcluding": "4.2.0", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}