CVE-2026-73643
js-yaml: Exponential parsing time in the flow collections leads to denial of service
Description
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2.
INFO
Published Date :
Aug. 13, 2026, 6:18 p.m.
Last Modified :
Oct. 24, 2026, 3:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE |
Solution
- Update js-yaml to version 5.2.2.
- Avoid parsing untrusted YAML with older versions.
- Implement input validation for YAML data.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-73643.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-73643 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-73643
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-73643 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-73643 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 24, 2026
Action Type Old Value New Value Changed Translation Title: js-yaml de nodeca, Description: js-yaml es un analizador y volcador YAML de JavaScript. Desde la versión 5.0.0 hasta la 5.2.2, el análisis de un documento YAML pequeño puede tomar tiempo exponencial cuando una aplicación llama a load() o loadAll() con una entrada no confiable. En src/parser/parser.ts, readFlowCollection utiliza restoreState y llama a parseNode una segunda vez cuando una entrada de secuencia de flujo se reconoce como un par clave: valor. Si la clave es una secuencia de flujo anidada de la misma forma, cada nivel se analiza dos veces, lo que provoca un trabajo de O(2^n) y permite que una entrada de menos de 200 bytes mantenga una CPU ocupada durante minutos, bloquee el bucle de eventos de Node.js y paralice el proceso. No se requieren anclas, alias, fusiones, etiquetas ni opciones no predeterminadas. Este problema se ha corregido en la versión 5.2.2. Title: js-yaml de nodeca, Description: js-yaml es un analizador y volcador YAML de JavaScript. Desde la versión 5.0.0 hasta la 5.2.2, el análisis de un documento YAML pequeño puede tomar tiempo exponencial cuando una aplicación llama a load() o loadAll() con una entrada no confiable. En src/parser/parser.ts, readFlowCollection utiliza restoreState y llama a parseNode una segunda vez cuando una entrada de secuencia de flujo se reconoce como un par clave: valor. Si la clave es una secuencia de flujo anidada de la misma forma, cada nivel se analiza dos veces, lo que provoca un trabajo de O(2^n) y permite que una entrada de menos de 200 bytes mantenga una CPU ocupada durante minutos, bloquee el bucle de eventos de Node.js y paralice el proceso. No se requieren anclas, alias, fusiones, etiquetas ni opciones no predeterminadas. Este problema se ha corregido en la versión 5.2.2. -
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Added Translation Title: js-yaml de nodeca, Description: js-yaml es un analizador y volcador YAML de JavaScript. Desde la versión 5.0.0 hasta la 5.2.2, el análisis de un documento YAML pequeño puede tomar tiempo exponencial cuando una aplicación llama a load() o loadAll() con una entrada no confiable. En src/parser/parser.ts, readFlowCollection utiliza restoreState y llama a parseNode una segunda vez cuando una entrada de secuencia de flujo se reconoce como un par clave: valor. Si la clave es una secuencia de flujo anidada de la misma forma, cada nivel se analiza dos veces, lo que provoca un trabajo de O(2^n) y permite que una entrada de menos de 200 bytes mantenga una CPU ocupada durante minutos, bloquee el bucle de eventos de Node.js y paralice el proceso. No se requieren anclas, alias, fusiones, etiquetas ni opciones no predeterminadas. Este problema se ha corregido en la versión 5.2.2. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 14, 2026
Action Type Old Value New Value Added Reference https://github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5 Added SSVC {'id': 'CVE-2026-73643', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-14T16:43:36.799144Z'} -
New CVE Received by [email protected]
Aug. 13, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'nodeca', 'product': 'js-yaml', 'versions': [{'status': 'affected', 'version': '>= 5.0.0, < 5.2.2'}]}] Added Description js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-407 Added Reference https://github.com/nodeca/js-yaml/commit/3e5240f9cbe645ce5afb58524954a13c8539c853 Added Reference https://github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5