js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.
| Vendor | Product | Versions |
|---|---|---|
| nodeca | js-yaml | >= 4.0.0, < 4.2.0, < 3.15.0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| ibm | app connect enterprise | cert_advisory | 90% |
| npm | js-yaml | GHSA | 85% |
Updated description with new details, changed affected versions to < 4.1.x, updated severity to HIGH, and added CVE-2026-53550.
Initial creation
