Is CVE-2026-33532 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33532 being exploited in the wild.

How severe is CVE-2026-33532?

Low severity, with a CVSS score of 3.1, published 25 March 2026.

Which products and versions are affected?

Yaml SEMVER:introduced=2.0.0,fixed=2.8.3.

Is there a fix for CVE-2026-33532?

Yes. Yaml: upgrade to 2.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33532 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-33532?

Check whether you run Yaml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33532: yaml stack overflow via deeply nested collections

CVE-2026-33532 · Severity: low · CVSS 3.1 · Published 2026-03-25

The yaml JavaScript library is vulnerable to a denial-of-service condition when parsing YAML documents with deeply nested collections. An attacker can supply a small malicious YAML payload (as small as 2–10 KB) that triggers a stack overflow, causing the application to throw an unhandled exception and potentially crash. Applications that only expect YAML-specific errors may fail to catch this exception type, leading to service disruption.

Quick answers

Is CVE-2026-33532 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33532 being exploited in the wild.
How severe is CVE-2026-33532?: Low severity, with a CVSS score of 3.1, published 25 March 2026.
Which products and versions are affected?: Yaml SEMVER:introduced=2.0.0,fixed=2.8.3.
Is there a fix for CVE-2026-33532?: Yes. Yaml: upgrade to 2.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33532 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-33532?: Check whether you run Yaml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Yaml: upgrade to 2.8.3 or later

Technical details

The vulnerability exists in the node composition/resolution phase of yaml's parser, which uses recursive function calls without depth bounds. While the CST (Concrete Syntax Tree) phase uses iterative stack-based processing and is unaffected, the compose/resolve phase recursively processes nested nodes. Flow sequences are particularly efficient for exploitation, requiring only 2 bytes per nesting level (one `[` and one `]`). On typical Node.js environments with default stack sizes, approximately 1,000–5,000 levels of nesting (2–10 KB input) exhaust the call stack and trigger a RangeError. The exception is not a YAMLParseError, so applications that selectively catch only YAML-specific errors will encounter an unexpected exception type. All three public parsing APIs are affected: `YAML.parse()`, `YAML.parseDocument()`, and `YAML.parseAllDocuments()`. Patches addressing this issue were released in versions 1.10.3 and 2.8.3, which catch the stack overflow and convert it to a YAMLParseError with code `RESOURCE_EXHAUSTION`.

Affected products

eemeli yaml 1.0.0 through 1.10.2, 2.0.0 through 2.8.2

Identifiers

CVE-2026-33532
GHSA-48c2-rrv3-qjmp

Timeline

2026-03-25: disclosed: Security advisory published on GitHub
2026-03-21: patched: Fix committed (v1.10.3 and v2.8.3 released on March 21, 2026)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.