Inefficient Algorithmic Complexity Affecting js-yaml package, versions <5.2.2
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-JSYAML-18313070
- published26 Jul 2026
- disclosed24 Jul 2026
- creditAlicia Sykes
Introduced: 24 Jul 2026
New CVE NOT AVAILABLE CWE-407 (opens in a new tab)How to fix?
Upgrade js-yaml to version 5.2.2 or higher.
Overview
js-yaml is a human-friendly data serialization language.
Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the readFlowCollection function of parser.ts, which reaches exponential time when a flow sequence entry turns out to be a key: value pair and the parser rewinds to parse that entry a second time as the key. An attacker can exhaust CPU and block the Node event loop by supplying a small YAML document, under 200 bytes, with deeply nested flow sequences of key: value entries, since the re-parsing makes the work grow as O(2^n) in nesting depth. Exploitation occurs under the default configuration when the application parses untrusted YAML with load() or loadAll(), and needs no special schema, anchors, aliases, or merge keys.