CVE-2026-33532

Aliases:GHSA-48c2-rrv3-qjmp
Advisory lineage Upstream: 0 Downstream: 6
Analyzed
Published: 26 Mar 2026, 19:49
Last modified:30 Mar 2026, 11:26

Vulnerability Summary

Overall Risk (default)
medium
27/100
CVSS Score
4.3 MEDIUM
v3.1 (cve.org)
EPSS Score
0.47% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

26 Mar 2026, 19:49
Published
Vulnerability first disclosed
30 Mar 2026, 11:26
Last Modified
Vulnerability information updated

Description

`yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a `RangeError: Maximum call stack size exceeded` with a small payload (~2–10 KB). The `RangeError` is not a `YAMLParseError`, so applications that only catch YAML-specific errors will encounter an unexpected exception type. Depending on the host application's exception handling, this can fail requests or terminate the Node.js process. Flow sequences allow deep nesting with minimal bytes (2 bytes per level: one `[` and one `]`). On the default Node.js stack, approximately 1,000–5,000 levels of nesting (2–10 KB input) exhaust the call stack. The exact threshold is environment-dependent (Node.js version, stack size, call stack depth at invocation). Note: the library's `Parser` (CST phase) uses a stack-based iterative approach and is not affected. Only the compose/resolve phase uses actual call-stack recursion. All three public parsing APIs are affected: `YAML.parse()`, `YAML.parseDocument()`, and `YAML.parseAllDocuments()`. Versions 1.10.3 and 2.8.3 contain a patch.

CVSS Metrics

  • v3.1•MEDIUM•Score: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS Trends

Current EPSS score: 0.47%• Percentile: 37%

Techniques & Countermeasures

  • CWE-674•Uncontrolled Recursion

    The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected Systems

  • eemeli•yaml

    ≥ 1.0.0, < 1.10.3 | ≥ 2.0.0, < 2.8.3

  • Npm•yaml

    ≥ 2.0.0, < 2.8.3 | ≥ 1.0.0, < 1.10.3

References (6)