EUVD-2026-58185
GHSA-pm4m-ph32-ghv5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable via any HTTP endpoint calling load(); no auth or special config required; sole impact is complete availability loss from event-loop saturation; no confidentiality or integrity effect.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4Blast Radius
ecosystem impact- 8 npm packages depend on js-yaml (7 direct, 1 indirect)
Ecosystem-wide dependent count for version 5.0.0.
DescriptionCVE.org
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2.
Articles & Coverage 1
AnalysisAI
Exponential parsing time in js-yaml 5.0.0 through 5.2.1 enables unauthenticated remote denial of service via a crafted YAML payload under 200 bytes. The parser's flow-collection logic re-parses nested flow-sequence keys rather than caching results, producing O(2^n) work per nesting level - approximately 30 levels suffices to stall a Node.js process for over two minutes on a single CPU. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The application must call js-yaml's `load()` or `loadAll()` on input that is fully or partially controlled by an untrusted party, such as HTTP request bodies, query parameters, file uploads, or webhook payloads. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) accurately captures the threat model: no authentication, no user interaction, default configuration, and complete availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a single HTTP request with a body containing `[ `.repeat(30) + `1` + ` ]: 0`.repeat(30) - a 30-level nested flow sequence under 200 bytes - to any endpoint that passes request content to `js-yaml`'s `load()` or `loadAll()`. The parser enters the exponential re-parse loop, saturating one CPU core for over two minutes and blocking the Node.js event loop, which causes the server to stop responding to all other concurrent requests. … |
| Remediation | Upgrade js-yaml to version 5.2.2, the vendor-released patch that resolves this issue via commit 3e5240f9cbe645ce5afb58524954a13c8539c853 (https://github.com/nodeca/js-yaml/commit/3e5240f9cbe645ce5afb58524954a13c8539c853). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Node.js applications to identify those using js-yaml 5.0.0-5.2.1; isolate or restrict network access to affected services if immediate remediation is unavailable. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today