Algorithmic CPU Exhaustion in js-yaml Parser Affecting Node.js

CVE-2026-53550

What is CVE-2026-53550?

The js-yaml library, a widely-used JavaScript YAML parser and dumper, contains a vulnerability that allows for algorithmic CPU exhaustion during merge-key processing. Attackers can exploit this flaw by crafting specific YAML documents that leverage repeated aliases within a merge sequence. As a result, the parser exhibits quadratic parsing behavior, leading to excessive CPU usage and potential blocking of Node.js worker/event loops for several seconds, even when handling relatively small payloads. This vulnerability has been addressed in version 4.2.0 of the library. For more information, visit the official advisory.

References