CVE-2026-53550

Aliases:GHSA-h67p-54hq-rp68
Advisory lineage Upstream: 0 Downstream: 7
PUBLISHED
Published: 22 Jun 2026, 14:59
Last modified:29 Jun 2026, 15:06

Vulnerability Summary

Overall Risk (default)
low
21/100
CVSS Score
5.3 MEDIUM
v3.1 (cve.org)
EPSS Score
0.26% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

22 Jun 2026, 14:59
Published
Vulnerability first disclosed
29 Jun 2026, 15:06
Last Modified
Vulnerability information updated

Description

js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS Trends

Current EPSS score: 0.26%• Percentile: 17%

Techniques & Countermeasures

  • CWE-407•Inefficient Algorithmic Complexity

    An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Affected Systems

  • nodeca•js-yaml

    < 4.2.0 | ≥ 4.0.0, < 4.2.0 | < 3.15.0

  • Npm•js-yaml

    < 4.2.0 | ≥ 4.0.0, < 4.2.0 | < 3.15.0

References (3)