Executive brief
A vulnerability in the js-yaml library, which is used to parse YAML data in Node.js applications, allows an attacker to crash or freeze a service. By sending a specially crafted, very small YAML file, an attacker can force the server's processor to work indefinitely, making the application unavailable to legitimate users. This can lead to a total service outage with minimal effort from the attacker.
Technical details
The js-yaml parser exhibits inefficient algorithmic complexity (CWE-407) when processing nested flow collections. Specifically, in the `readFlowCollection` function within `parser.ts`, the parser may rewind and re-parse entries multiple times if they are identified as key-value pairs. When these keys are themselves nested flow sequences, the computational work grows exponentially (O(2^n)) relative to the nesting depth. An attacker can trigger this with a payload under 200 bytes, bypassing the default `maxDepth` limit of 100. This blocks the Node.js event loop and leads to a denial of service. The issue is fixed in version 5.2.2.
Affected products
- nodeca js-yaml >= 5.0.0, <= 5.2.1
Timeline
- 2026-07-23: disclosed
- 2026-07-23: patched: Fixed in version 5.2.2
- 2026-07-24: advisory