Description

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T18:18:19.947Z",
  "pubdate": "2026-08-13T18:18:19.947Z",
  "executiveSummary": "An algorithmic complexity vulnerability exists in the js-yaml JavaScript YAML parser and dumper, specifically impacting versions 5.0.0 through 5.2.2. The flaw enables unauthenticated remote attackers to trigger a severe denial-of-service condition by supplying specially crafted, highly compressed YAML payloads under 200 bytes in size. When applications utilize the load() or loadAll() functions to parse untrusted input, the vulnerable parsing logic encounters exponential computational complexity, resulting in $O(2^n)$ work execution time. This forces the single-threaded Node.js event loop to block completely, keeping a CPU core fully saturated for minutes and effectively stalling the entire hosting process. The risk implications are severe for availability, as minimal computational effort by an attacker leads to disproportionately high resource exhaustion on the server side. No complex features such as anchors, aliases, merges, tags, or nondefault options are required to facilitate this exploitation vector, making the attack surface broad for any application processing external YAML inputs.",
  "technicalDetails": "The vulnerability resides within the source file src/parser/parser.ts, specifically inside the readFlowCollection function. The root cause stems from the parser's state-handling mechanism when processing flow sequences. During parsing, readFlowCollection utilizes restoreState and triggers a recursive invocation of parseNode a second time whenever a flow-sequence entry is successfully recognized as a key-value pair. When an attacker provides a crafted YAML payload where the key consists of a nested flow sequence structurally identical to the parent, the backtracking logic exponentially multiplies the parsing operations. Consequently, every nested level of the flow sequence is parsed twice, inducing an exponential computational complexity of $O(2^n)$. An attacker can construct an input payload under 200 bytes that exploits this duplicate processing behavior. Step-by-step, the attack flow begins when an application passes the untrusted YAML string to the load() or loadAll() methods. The parser initiates traversal of the flow collection via readFlowCollection. Upon encountering the nested flow-sequence key-value pair pattern, the function executes restoreState and re-invokes parseNode. Because of the self-similar nested shape of the payload, this routine compounds recursively at every layer. The affected versions are 5.0.0 through 5.2.2. The vulnerability requires no authentication, no special privileges, and no network configuration beyond the ability to supply input data to an application parsing YAML. The payload behavior does not involve memory corruption or remote code execution; rather, it exclusively targets system availability through CPU resource exhaustion, stalling the Node.js event loop and rendering the host process unresponsive to legitimate traffic."
}