CVE-2026-53550
MEDIUM EPSS 17.2%
Published Jun 22, 20261w ago · Modified Jun 23, 20261w ago
5.3 CVSS 3.1
Published Jun 22, 2026 1w ago
Last Modified Jun 23, 2026 1w ago
Description
js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability Low
Threat Intelligence
EPSS Exploit Probability
17.2% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-407
References 1
- github.com https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.