Skip to main content

Node.js CVE-2026-33532

MEDIUM
Uncontrolled Recursion (CWE-674)
2026-03-25 https://github.com/eemeli/yaml
Buffer Overflow Node.js Apple Red Hat Suse
4.3
CVSS 3.1 · GitHub Advisory
View

Vulnerability Assessment

Weakness
CWE
CWE-674
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
Impact

This vulnerability presents moderate but non-trivial real-world risk. The CVSS 3.1 score of 4.3 reflects the attack vector (network-accessible), low attack complexity, requirement for authentication privileges, and impact limited to availability. However, critical risk signals include: (1) proof-of-concept code exists and is trivial to execute; (2) the attack is highly automatable—no user interaction required; (3) the technical impact is process termination or cascading failures in applications that do not expect RangeError exceptions from parsing operations; (4) the affected library is widely used in Node.js ecosystems without obvious version constraints. Exploitation probability is high given low attack complexity and small payload requirements, though the authentication requirement and low CVSS score suggest this is not a critical priority compared to network-based RCE vulnerabilities. Organizations using yaml versions 2.8.2 or earlier in production environments with untrusted input handling should prioritize patching, particularly in multi-tenant or public-facing services. The vulnerability is not listed in CISA KEV (no active exploitation reported), reducing urgency slightly, but the existence of a functional POC and three years of affected versions (1.0.0 through 2.8.2) indicate latent exploitation risk.
Exploit ScenarioDerived

A web application accepts YAML configuration files uploaded by authenticated users through a REST API endpoint. An attacker with valid credentials crafts a minimal 10 KB payload of nested flow sequences (5,000 levels: [[[...[1]...]]]) and submits it as a configuration file. The application's YAML.parse() call triggers unbounded recursion in the compose/resolve phase, exhausting the Node.js call stack and throwing a RangeError that the application does not explicitly catch (it only catches YAMLParseError). The uncaught exception crashes the Node.js process, causing a denial of service affecting all users of the service. If the application restarts the process automatically, the attacker can repeatedly submit the same small payload to cause repeated service disruptions with minimal bandwidth usage and no special network privileges required.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 25, 2026

YAML parsing in Node.js and Apple products fails to enforce recursion depth limits, allowing an attacker to trigger a stack overflow with minimal input (2-10 KB of nested flow sequences) that crashes the application with an uncaught RangeError. Applications relying solely on YAML-specific exception handling may fail to catch this error, potentially leading to process termination or service disruption. A patch is available for affected versions.

Earlier versions of this analysis (1)
v1 Mar 25, 2026 - 20:17 CVSS 4.3

A stack overflow vulnerability exists in the YAML parsing library (pkg:npm/yaml) affecting all versions prior to 1.10.3 and 2.8.3, where the compose/resolve phase uses unbounded recursive function calls during YAML document processing. An attacker with low privileges can supply a small malicious YAML payload (2-10 KB) containing deeply nested flow sequences to trigger a RangeError exception that is not caught by YAML-specific error handlers, potentially causing denial of service through request failures or Node.js process termination. A proof-of-concept exploit exists demonstrating successful trigger with ~5,000 levels of nesting using minimal input size.

RemediationAI

Immediately upgrade the yaml npm package to version 1.10.3 or later (for v1.x branch) or version 2.8.3 or later (for v2.x branch) as documented in the vendor security advisory at https://github.com/eemeli/yaml/security/advisories/GHSA-48c2-rrv3-qjmp. Update package.json dependencies and run npm install or yarn upgrade accordingly. If immediate patching is not feasible, implement input size validation on YAML documents prior to parsing—reject payloads exceeding a reasonable threshold (e.g., 1 MB for most use cases, lower if acceptable) and implement broader exception handling to catch RangeError in addition to YAMLParseError, either by wrapping parse calls in try-catch blocks that handle both error types or by monitoring uncaught exception handlers. Additionally, restrict YAML parsing operations to trusted input sources where possible and consider implementing resource limits (e.g., Node.js --max-old-space-size and stack size tuning) as temporary mitigations, though these are not substitutes for the patch.

Affected Packages

npm yaml fix: 1.10.3, 2.8.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The yaml library (CPE: pkg:npm/yaml) is a popular Node.js YAML parser used across the ecosystem. The vulnerability resides specifically in the composition and resolution phase of YAML parsing, which uses recursive function calls without enforced depth limits (CWE-674: Uncontrolled Recursion). The Parser component itself uses an iterative stack-based approach and is not vulnerable; only the public APIs (YAML.parse, YAML.parseDocument, YAML.parseAllDocuments) that invoke the compose/resolve phase are affected. Flow sequences in YAML syntax allow extremely compact nesting (2 bytes per level: [ and ]), enabling approximately 1,000-5,000 levels of nesting within 2-10 KB of input—well below typical payload size limits. When the recursion depth exceeds the Node.js call stack limit (environment-dependent on Node.js version and initial stack depth), a RangeError rather than a YAMLParseError is thrown, breaking exception handling assumptions in consuming applications.

Know when Node.js gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
SUSE MEDIUM
Red Hat 6.5 MEDIUM

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

2
Patch released
Mar 25, 2026 - 20:17 nvd
Patch available
CVE Published
Mar 25, 2026 - 20:08 nvd
MEDIUM 4.3

DescriptionGitHub Advisory

Parsing a YAML document with yaml may throw a RangeError due to a stack overflow.

The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a RangeError: Maximum call stack size exceeded with a small payload (~2-10 KB). The RangeError is not a YAMLParseError, so applications that only catch YAML-specific errors will encounter an unexpected exception type. Depending on the host application's exception handling, this can fail requests or terminate the Node.js process.

Flow sequences allow deep nesting with minimal bytes (2 bytes per level: one [ and one ]). On the default Node.js stack, approximately 1,000-5,000 levels of nesting (2-10 KB input) exhaust the call stack. The exact threshold is environment-dependent (Node.js version, stack size, call stack depth at invocation).

Note: the library's Parser (CST phase) uses a stack-based iterative approach and is not affected. Only the compose/resolve phase uses actual call-stack recursion.

All three public parsing APIs are affected: YAML.parse(), YAML.parseDocument(), and YAML.parseAllDocuments().

PoC

javascript
const YAML = require('yaml');

// ~10 KB payload: 5000 levels of nested flow sequences
const payload = '['.repeat(5000) + '1' + ']'.repeat(5000);

try {
  YAML.parse(payload);
} catch (e) {
  console.log(e.constructor.name); // RangeError (NOT YAMLParseError)
  console.log(e.message);          // Maximum call stack size exceeded
}

Test environment: Node.js v24.12.0, macOS darwin arm64

VersionNesting DepthInput SizeResult
1.0.05,00010,001 BRangeError
1.10.25,00010,001 BRangeError
2.0.05,00010,001 BRangeError
2.8.25,00010,001 BRangeError
2.8.35,00010,001 BYAMLParseError

Depth threshold on yaml 2.8.2:

Nesting DepthInput SizeResult
5001,001 BParses successfully
1,0002,001 BRangeError (threshold varies by stack size)
5,00010,001 BRangeError

Executive ViewAI

Why It Matters

CVE-2026-33532 presents moderate security risk rated CVSS 4.3. Exploitation could compromise the security of affected deployments. A patch is available and should be applied during regular vulnerability management.

Business Impact: Low
Compensating Controls

Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.

Threat Intelligence Overview

EPSS Score
0.0%
Top 86% exploitable
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
Poc
System Exposure· derived
Open
Automatable
No
Human Impact
Low
Technical Impact
Partial

Priority Score

22
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +22
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Affected Products (CPE)GitHub Advisory

pkg:npm/yaml
pkg:npm/yaml

More in Node.js

View all
CVE-2025-68613 HIGH POC
8.8 Dec 19

Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2024-35286 CRITICAL POC
9.8 Oct 21

A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to cond

Same weakness CWE-674 – Uncontrolled Recursion

View all
CVE-2019-9545 HIGH POC
8.8
CVE-2019-9543 HIGH POC
8.8
CVE-2019-9144 HIGH POC
8.8
CVE-2019-9143 HIGH POC
8.8
CVE-2026-66393 HIGH POC
8.7
CVE-2026-18140 HIGH POC
8.7
CVE-2026-93687 HIGH POC
8.7
CVE-2026-9769 HIGH POC
8.7

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed

References

Advisories & patches
PATCH https://github.com/eemeli/yaml/commit/1e84ebbea7ec35011a4c61bbb820a529ee4f359b ADVISORY https://github.com/eemeli/yaml/security/advisories/GHSA-48c2-rrv3-qjmp ADVISORY https://vuldb.com/vuln/353740 REF https://github.com/advisories/GHSA-48c2-rrv3-qjmp REF https://github.com/eemeli/yaml/releases/tag/v1.10.3 REF https://github.com/eemeli/yaml/releases/tag/v2.8.3

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy