Executive brief
js-yaml is a popular YAML parsing library used in Node.js applications to process YAML configuration files and data. A flaw in its parser allows attackers to send a small malicious YAML document (under 200 bytes) that causes the parser to consume exponential CPU time, freezing the entire application process and denying service to legitimate users.
Technical details
The vulnerability exists in the readFlowCollection function of parser.ts, where the parser handles nested flow sequences containing key-value pairs. When the parser detects that a flow sequence entry is actually a key-value pair, it rewinds and reparses that entry as a key. If that key is itself a nested flow sequence with the same structure, the reparse happens at every nesting level, resulting in O(2^n) time complexity relative to nesting depth. The attack requires no special options or tags—it triggers with default settings on straightforward YAML input. Attackers can craft payloads with approximately 30–40 levels of nesting that take minutes to parse, blocking the Node.js event loop and stalling the entire process. The fix (version 5.2.2) wraps already-parsed key events in a synthetic flow mapping instead of rewinding and reparsing.
Affected products
- js-yaml contributors js-yaml 5.0.0 through 5.2.1
Timeline
- 2026-07-24: disclosed
- 2026-07-24: patched: Fixed in version 5.2.2