# CVE-2026-73643: js-yaml exponential parsing time in flow collections denial of service

Source: https://junglewise.ai/threats/cve-2026-73643-js-yaml-exponential-parsing-time-in-flow-collections-denial-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73643 · Severity: high · CVSS 7.5 · Published 2026-08-13

js-yaml is a popular YAML parsing library used in Node.js applications to process YAML configuration files and data. A flaw in its parser allows attackers to send a small malicious YAML document (under 200 bytes) that causes the parser to consume exponential CPU time, freezing the entire application process and denying service to legitimate users.

Technologies: [js-yaml (npm)](https://junglewise.ai/threats/technologies/js-yaml). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-73643 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73643 being exploited in the wild.

**How severe is CVE-2026-73643?** High severity, with a CVSS score of 7.5, published 13 August 2026.

**Which products and versions are affected?** js-yaml (npm) SEMVER:introduced=5.0.0,fixed=5.2.2.

**Is there a fix for CVE-2026-73643?** Yes. js-yaml (npm): upgrade to 5.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73643 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73643?** Check whether you run js-yaml (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- js-yaml (npm): upgrade to 5.2.2 or later

  ```sh
  npm install js-yaml@5.2.2
  ```


## Technical details

The vulnerability exists in the readFlowCollection function of parser.ts, where the parser handles nested flow sequences containing key-value pairs. When the parser detects that a flow sequence entry is actually a key-value pair, it rewinds and reparses that entry as a key. If that key is itself a nested flow sequence with the same structure, the reparse happens at every nesting level, resulting in O(2^n) time complexity relative to nesting depth. The attack requires no special options or tags—it triggers with default settings on straightforward YAML input. Attackers can craft payloads with approximately 30–40 levels of nesting that take minutes to parse, blocking the Node.js event loop and stalling the entire process. The fix (version 5.2.2) wraps already-parsed key events in a synthetic flow mapping instead of rewinding and reparsing.

## Affected products

- js-yaml contributors js-yaml 5.0.0 through 5.2.1

## Identifiers

- CVE-2026-73643
- GHSA-pm4m-ph32-ghv5

## Timeline

- 2026-07-24: disclosed
- 2026-07-24: patched: Fixed in version 5.2.2

## References

- [https://github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5](https://github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5)
- [https://github.com/nodeca/js-yaml/commit/3e5240f9cbe645ce5afb58524954a13c8539c853](https://github.com/nodeca/js-yaml/commit/3e5240f9cbe645ce5afb58524954a13c8539c853)

## Related threats

- [js-yaml CPU exhaustion via merge keys with empty mappings](https://junglewise.ai/threats/js-yaml-maxtotalmergekeys-does-not-limit-cpu-use-for-empty-merge-e18172a3)
- [js-yaml YAML merge CPU consumption DoS](https://junglewise.ai/threats/cve-2026-84375-js-yaml-denial-of-service-via-empty-merge-sources)
- [JS-YAML quadratic CPU consumption in !!omap resolution](https://junglewise.ai/threats/js-yaml-quadratic-cpu-consumption-in-omap-resolution-f21ac1bd)
- [nodeca js-yaml denial of service in YAML11_SCHEMA omap parsing](https://junglewise.ai/threats/cve-2026-59870-nodeca-js-yaml-denial-of-service-in-yaml11-schema-omap-parsing)
- [nodeca js-yaml denial of service via merge key chains](https://junglewise.ai/threats/cve-2026-59869-nodeca-js-yaml-denial-of-service-via-merge-key-chains)