JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

Vulnerability

CVE-2026-53550 is an algorithmic CPU-exhaustion vulnerability in js-yaml's merge-key processing (<<:) in lib/loader.js [1][2]. When a YAML document contains a merge sequence that repeats the same anchored alias many times (e.g., <<: [*a, *a, ..., *a]), the storeMappingPair() function iterates over every element and calls mergeMappings() for each one without deduplication [1][2]. mergeMappings() recomputes Object.keys(source) and performs _hasOwnProperty checks on all keys for every redundant merge [1][2]. Affected versions include all releases up to (but not including) the patched version; the repository’s advisory notes the issue exists in the merge branch of lib/loader.js [2].

Exploitation

An attacker needs only the ability to supply a YAML document to a Node.js application that uses js-yaml to parse untrusted input [1][2]. No authentication or special network position is required beyond sending the payload. The crafted document is of the form: a: &a {k0:0, k1:0, ..., kK:0} followed by b: {<<: [*a, *a, *a, ... repeated M times]} [1][2]. The payload size is roughly O(K + M) but the parsing work scales as O(K * M), producing quadratic CPU consumption [1][2]. With a relatively small payload (tens of kilobytes), the parser can block the Node.js event loop for seconds, enabling a denial-of-service condition [1][2].

Impact

Successful exploitation causes a denial of service (DoS) by monopolizing CPU time in a single parse operation, preventing the Node.js worker from handling other events [1][2]. The vulnerability does not result in information disclosure, data modification, or privilege escalation; the impact is purely on availability [1][2]. The attack requires no special privileges or user interaction beyond document submission [1][2].

Mitigation

The vulnerability is not yet fixed as of the available references. Users should monitor the js-yaml repository for a patched release. At time of publication, no advisory contains a fixed version number [1][2]. Until a fix is released, developers can mitigate the risk by avoiding the use of js-yaml to parse untrusted YAML documents that contain merge keys (<<:), or by applying input-size and complexity limits upstream [1][2]. The CVE is not listed on CISA’s Known Exploited Vulnerabilities (KEV) catalog.