CVE-2026-53550: js-yaml Merge-Key CPU Exhaustion Denial of Service

Technical summary

The vulnerability resides in js-yaml's merge-key processing within lib/loader.js. When a YAML document contains a merge key (<<) followed by repeated references to the same alias, the parser exhibits quadratic time complexity relative to input size. This algorithmic flaw means that parse time grows dramatically—not linearly—with the number of alias repetitions, allowing an attacker to craft inputs that trigger worst-case behavior. The issue affects both the 3.x and 4.x branches of js-yaml prior to the patched versions.

Business impact

For Node.js applications that parse untrusted or user-supplied YAML—such as configuration loaders, data import services, or API parsers—this vulnerability poses a direct availability risk. A denial-of-service attack requires no authentication and no user interaction, making it trivially exploitable by external attackers. Services may become unresponsive, affecting SLAs and user experience. Organizations running vulnerable versions in containerized or serverless environments may face scaling penalties as platforms attempt to recover from blocked event loops.

Affected systems

The vulnerability affects js-yaml versions prior to 4.2.0 (in the 4.x line) and prior to 3.15.0 (in the 3.x line). Any Node.js application or library that depends on js-yaml for YAML parsing is at risk if running an unpatched version. This includes npm packages that bundle js-yaml as a dependency, making the blast radius potentially large across the JavaScript ecosystem.

Exploitability

Exploitability is high. The attack requires no authentication, no special privileges, and no user interaction—an attacker simply needs to submit a crafted YAML payload to a vulnerable service. The network is the only required vector, and the payload is small enough to pass through typical size restrictions. No complex interaction is needed; a single malicious YAML document triggers the condition. The only limiting factor is that the target application must parse the YAML—but in many use cases (config files, data imports, API inputs), this is standard behavior.

Remediation

Upgrade js-yaml to version 4.2.0 or later if using the 4.x branch, or to version 3.15.0 or later if using the 3.x branch. Verify the upgrade by checking package.json and running npm audit to confirm the vulnerability is resolved. For applications that cannot upgrade immediately, consider implementing input validation or size limits on YAML documents, though patching is the definitive fix.

Patch guidance

Coordinate the patch deployment during a standard maintenance window. Because js-yaml is often a transitive dependency, ensure that all direct and indirect consumers are updated. Run npm ci or npm install after updating to pull the corrected version. Test parsing of your application's typical YAML payloads to ensure no unexpected side effects. For production environments, consider a rolling deployment to minimize service interruption.

Detection guidance

Identify vulnerable instances by auditing package.json and package-lock.json for js-yaml versions prior to 4.2.0 and 3.15.0. Use npm audit or similar supply-chain tools to flag dependencies. Monitor application logs for parsing timeouts or CPU spikes coinciding with YAML parsing operations—these may indicate exploitation attempts. If you suspect active exploitation, review request logs for unusually large or repeatedly structured YAML payloads.

Why prioritize this

Although the CVSS score is medium (5.3), the practical exploitability is high and the vector is network-accessible. Any public-facing or internal service that accepts YAML input from untrusted sources should prioritize patching. The fix is straightforward and introduces no breaking changes in practice. Organizations should not delay remediation, especially if the vulnerable library is exposed through APIs or configuration upload endpoints.

Risk score, explained

The CVSS v3.1 score of 5.3 reflects a network-accessible denial-of-service condition with low complexity and no privilege requirement. The integrity and confidentiality of data remain unaffected, limiting the score to availability impact. However, the practical risk to operations is elevated: the ability to freeze a Node.js process with a tens-of-kilobyte payload is a potent disruption vector. Organizations running mission-critical services should treat this as a near-term priority despite the medium severity rating.

Frequently asked questions