VYPR
← All advisories
Medium severity5.3GHSA Advisory· Published Jun 22, 2026· Updated Jul 9, 2026

CVE-2026-53550

CVE-2026-53550

Description

js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
js-yamlnpm
>= 4.0.0, < 4.2.04.2.0
js-yamlnpm
< 3.15.03.15.0

Affected products

143

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.