CoreCVE
Back

HIGH

js-yaml: Exponential parsing time in the flow collections leads to denial of service

Published Aug 13, 2026

Description

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2.

Affected products

Remediation

Red Hat statement

This is an Important denial-of-service flaw in the `js-yaml` library, where processing specially crafted YAML input can lead to exponential parsing time. This can cause applications utilizing affected versions of `js-yaml` within Red Hat products to consume excessive CPU resources, potentially blocking the Node.js event loop and leading to service unavailability.

Red Hat mitigation

To mitigate this issue, restrict applications from processing untrusted YAML input with affected versions of the `js-yaml` library. Implement strict input validation to ensure that only trusted and well-formed YAML data is processed. If the application is exposed to external, untrusted sources, consider isolating the application or implementing additional resource limits to prevent complete service disruption.

Metrics

Weaknesses (2)

CWE-1333

CWE-407

References (8)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published Aug 13, 2026
Updated Aug 14, 2026
Reserved Aug 13, 2026
Link CVE-2026-73643
CISA Vulnrichment
Updated Aug 14, 2026
NVD
Status Deferred
Modified Sep 18, 2026
Link CVE-2026-73643
Red Hat
Severity Important
Public date Aug 13, 2026
Links CVE-2026-73643 - Bugzilla
GHSA-PM4M-PH32-GHV5