Back to overview

CVE-2026-53550

MEDIUM
5.3
CVSS 3.1
Description
js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0.

Metadata

CVE ID
CVE-2026-53550
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-06-09 18:13 UTC
Published
2026-06-22 14:59 UTC
Last updated
2026-06-22 14:59 UTC
Primary CWE
CWE-407
CWE-407: Inefficient Algorithmic Complexity
Vendor / Product
nodeca / js-yaml
Sources
cve.org  ·  NVD

Severity & Metrics

5.3 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products (1)
VendorProductPlatformVersions
nodeca js-yaml — < 4.2.0
Weakness (CWE)
CWESourceDescription
CWE-407 cna CWE-407: Inefficient Algorithmic Complexity
CVSS scores (1)
ScoreSeverityVersionSourceVector
5.3 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References (1)
Back to overview