medium5.3
CVE-2026-53550
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
Impact
js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | js-yaml | >= 4.0.0, <= 4.1.1 | 4.2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nodeca | Js-Yaml | before 3.15.0 from 4.0.0 before 4.2.0 |