CVE-2026-73643
Received Received - Intake

js-yaml Exponential Time Complexity in YAML Parsing

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73643
EUVD
EUVD-2026-58185

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
nodeca js-yaml From 5.0.0 (inc) to 5.2.2 (exc)
nodeca js-yaml to 5.2.2 (exc)
nodeca js-yaml 5.2.2
js-yaml js-yaml 5.2.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the js-yaml library versions 5.0.0 to 5.2.1. Parsing a small YAML document can take exponential time when the load() or loadAll() functions are called on untrusted input. The issue occurs when a flow sequence entry is parsed as a key-value pair, causing the parser to re-parse the same entry. Nested flow sequences multiply this effect, leading to O(2^n) complexity. A payload under 200 bytes can hang the parser for minutes.

Detection Guidance

To detect this vulnerability, monitor for processes consuming excessive CPU or hanging during YAML parsing. Check Node.js applications using js-yaml versions 5.0.0 to 5.2.1. Use commands like 'ps aux | grep node' to identify suspicious processes or 'top' to observe CPU usage spikes.

Impact Analysis

An attacker can exploit this to cause a denial of service by sending a small malicious YAML payload. This can consume CPU resources, block the Node.js event loop, and stall the entire process. Even a single request may render the application unresponsive for extended periods.

Compliance Impact

This vulnerability primarily impacts availability, which could lead to service disruptions. For GDPR, prolonged downtime may affect data processing timelines. For HIPAA, system unavailability could interfere with access to protected health information. Compliance may require mitigating the risk to ensure timely data access and processing.

Mitigation Strategies

Immediately upgrade js-yaml to version 5.2.2 or later. If upgrading is not possible, restrict input to trusted YAML documents or implement rate limiting to prevent abuse. Monitor affected applications for unusual CPU usage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73643. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart