CVE-2026-73643

Name of the Vulnerable Software and Affected Versions js-yaml versions 5.0.0 through 5.2.1

Description Parsing a small YAML document can lead to exponential time consumption when an application calls the load() or loadAll() functions on untrusted input. In the src/parser/parser.ts file, the readFlowCollection() function uses restoreState() and invokes parseNode() a second time when a flow-sequence entry is identified as a key: value pair. If the key is a nested flow sequence of the same shape, each level is parsed twice, resulting in O(2^n) complexity. This allows an input smaller than 200 bytes to saturate a CPU for several minutes, blocking the Node.js event loop and stalling the process. This behavior occurs without the need for anchors, aliases, merges, tags, or non-default options.

Recommendations Update js-yaml to version 5.2.2.