Performance Degradation in js-yaml Affects JavaScript Applications
CVE-2026-73643

7.5HIGH

Key Information:

Vendor

Nodeca

Status
Js-yaml
Vendor
CVE Published:
13 August 2026

What is CVE-2026-73643?

The js-yaml library, versions 5.0.0 to 5.2.2, contains a vulnerability that allows untrusted YAML input to cause significant performance issues. When the load() or loadAll() methods are executed on a small YAML document, the library can enter an exponential time complexity in its processing. This is due to the recursive nature of parsing nested flow sequences, where each nested entry may need to be parsed multiple times. This inefficiency could cause a Node.js process to remain unresponsive and block the event loop, impacting the performance of applications using the library. Users are advised to upgrade to version 5.2.2, where this issue has been resolved.

Affected Version(s)

js-yaml >= 5.0.0, < 5.2.2

References

https://github.com/nodeca/js-yaml/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/nodeca/js-yaml/commit/3e5240f9cbe645ce...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.