CVE-2026-53550

Description

js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.

CVSS Metrics

• v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS Trends

Current EPSS score: 0.39%• Percentile: 33%

Techniques & Countermeasures

• CWE-407•Inefficient Algorithmic Complexity

  An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Affected Systems

• chainguard•airflow-2

  all

• chainguard•airflow-3

  < 3.2.2-r8

• chainguard•airflow-core-2

  all

• chainguard•arangodb-3.11

  < 3.11.14.4-r5 | < 3.11.14.4-r7

• chainguard•arangodb-3.12

  < 3.12.9.4-r3

• chainguard•argo-workflows-ui-3.6

  < 3.6.19-r7

• chainguard•argo-workflows-ui-3.7

  < 3.7.15-r2

• chainguard•argo-workflows-ui-4.0

  < 4.0.6-r2 | < 4.0.11-r0

• chainguard•authentik-2025.12

  all

• chainguard•authentik-2026.2

  < 2026.2.5-r5

• chainguard•authentik-2026.5

  < 2026.5.3-r8

• chainguard•authentik-fips-2025.12

  all | < 2025.12.6-r13

• chainguard•authentik-fips-2026.2

  < 2026.2.6-r4

• chainguard•authentik-fips-2026.5

  < 2026.5.4-r0

• chainguard•awx

  < 24.6.1-r42

• chainguard•code-server

  < 4.124.2-r0

• chainguard•commercial-gitlab-rails-ee-19.1

  all

• chainguard•commercial-gitlab-rails-ee-19.2

  all

• chainguard•commercial-gitlab-rails-ee-19.3

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.1

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.2

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.3

  all

• chainguard•drupal-11.3

  < 11.3.13-r3

• chainguard•eslint

  < 10.5.0-r1

• chainguard•foxx-cli

  < 2.1.1-r8

• chainguard•gemini-cli

  < 0.49.0-r4

• chainguard•gitlab-rails-ce-18.1

  < 18.1.6-r38

• chainguard•gitlab-rails-ce-18.10

  all

• chainguard•gitlab-rails-ce-18.11

  all

• chainguard•gitlab-rails-ce-18.5

  all

• chainguard•gitlab-rails-ce-18.6

  all

• chainguard•gitlab-rails-ce-18.7

  all

• chainguard•gitlab-rails-ce-18.8

  all

• chainguard•gitlab-rails-ce-18.9

  all

• chainguard•gitlab-rails-ce-19.0

  < 19.0.3-r1 | all

• chainguard•gitlab-rails-ce-19.1

  all | < 19.1.7-r6

• chainguard•gitlab-rails-ce-19.2

  all | < 19.2.5-r2

• chainguard•gitlab-rails-ce-19.3

  < 19.3.1-r6

• chainguard•gitlab-rails-ce-fips-18.1

  all | < 18.1.6-r15

• chainguard•gitlab-rails-ce-fips-18.10

  all

• chainguard•gitlab-rails-ce-fips-18.11

  all

• chainguard•gitlab-rails-ce-fips-18.5

  all

• chainguard•gitlab-rails-ce-fips-18.6

  all

• chainguard•gitlab-rails-ce-fips-18.7

  all

• chainguard•gitlab-rails-ce-fips-18.8

  all

• chainguard•gitlab-rails-ce-fips-18.9

  all

• chainguard•gitlab-rails-ce-fips-19.0

  all

• chainguard•gitlab-rails-ce-fips-19.1

  < 19.1.6-r6 | < 19.1.1-r1

• chainguard•gitlab-rails-ce-fips-19.2

  all | < 19.2.5-r2

• chainguard•gitlab-rails-ce-fips-19.3

  < 19.3.1-r3

Showing first 50 affected entries in server-rendered view.

References (5)

• https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68
• https://github.com/nodeca/js-yaml
• https://nvd.nist.gov/vuln/detail/CVE-2026-53550
• https://security-tracker.debian.org/tracker/CVE-2026-53550
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53550.json