DEBIAN-CVE-2026-53550

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2026-53550
Published: 22 Jun 2026, 16:16
Last modified:30 Jun 2026, 05:00

Vulnerability Summary

Overall Risk (default)
low
21/100
CVSS Score
5.3 MEDIUM
3.1 (osv_debian)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

22 Jun 2026, 16:16
Published
Vulnerability first disclosed
30 Jun 2026, 05:00
Last Modified
Vulnerability information updated

Description

js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected Systems

  • debian•node-js-yaml

    all | all | all | all | < 4.2.0+~4.0.9-1

References (1)