CVE-2026-53550 — js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases

Description (CNA)

js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.

Affected (CNA)

Vendor / product	Versions
nodeca / js-yaml	affected >= 4.0.0, < 4.2.0; affected < 3.15.0

CWE

CWE-407

References

https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.