CVE-2026-73643: high-severity vulnerability in nodeca js-yaml
js-yaml: Exponential parsing time in the flow collections leads to denial of service
Published · Updated
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.5%
exploitation probability
0.5%top 60% of all CVEs
observed exploitation
nono source reports it
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
nodeca · js-yamlRelated CVEs — nodeca js-yaml
In the same product, most dangerous first.
CVE-2026-59870HIGHjs-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsingEPSS 0.7%CVE-2026-59868MEDIUMjs-yaml: YAML merge-key chains can force quadratic CPU consumptionEPSS 0.6%CVE-2026-59869HIGHjs-yaml: YAML merge-key chains can force quadratic CPU consumptionEPSS 0.6%CVE-2026-84375HIGHjs-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesEPSS 0.5%CVE-2026-53550MEDIUMjs-yaml: Quadratic-complexity DoS in merge key handling via repeated aliasesEPSS 0.4%CVE-2025-64718MEDIUMjs-yaml has prototype pollution in merge (<<)EPSS 0.4%