CVE-2026-53550 Details
Description
js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.
A denial-of-service vulnerability has been identified in js-yaml, a JavaScript YAML parser and dumper, in versions through 4.1.1. The issue arises in the merge-key processing feature, where a crafted YAML document can cause significant CPU exhaustion. This is achieved by repeating the same alias multiple times in a merge sequence, which triggers quadratic parse-time behavior relative to the input size. As a result, a Node.js worker or event loop can be blocked for several seconds, even with a relatively small payload of tens of kilobytes. The vulnerability is rooted in the merge handling within the 'lib/loader.js' file, where the parser inefficiently processes repeated aliases, leading to excessive computational overhead.
Users can upgrade to js-yaml version 4.2.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-407 | Inefficient Algorithmic Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nodeca js-yaml | < 3.15.0 >= 4.0.0, < 4.2.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | Modified Analysis | [email protected] |
| Jun 29, 2026 | CVE Modified | [email protected] |
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |