What is the CVSS score of CVE-2026-73643?

CVE-2026-73643 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of js-yaml are affected by CVE-2026-73643?

js-yaml versions 5.0.0-5.2.1 contain an unauthenticated remote denial of service vulnerability-publicly available exploit code exists.. A patch is available.

Is there a public PoC exploit available for CVE-2026-73643?

Yes, a public proof-of-concept exploit is available for CVE-2026-73643. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-73643?

Within 24 hours: inventory all Node.js applications to identify those using js-yaml 5.0.0-5.2.1; isolate or restrict network access to affected services if immediate remediation is unavailable. Within 7 days: downgrade to js-yaml 4.x or evaluate upgrading to versions released after 5.2.1 (if available); test thoroughly in staging environments before production deployment. Within 30 days: complete deployment of remediated versions across all production and non-production environments; implement input validation to limit YAML payload sizes, enable rate limiting on endpoints processing YAML input, and configure network segmentation to restrict YAML sources to trusted internal systems.

js-yaml CVE-2026-73643

EUVD-2026-58185 HIGH

Inefficient Algorithmic Complexity (CWE-407)

2026-08-13 security-advisories@github.com

GHSA-pm4m-ph32-ghv5

Information Disclosure Node.js

7.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable via any HTTP endpoint calling load(); no auth or special config required; sole impact is complete availability loss from event-loop saturation; no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Aug 13, 2026 - 19:04 EUVD

Source Code Evidence Fetched

Aug 13, 2026 - 18:32 vuln.today

Analysis Generated

Aug 13, 2026 - 18:32 vuln.today

CVE Published

Aug 13, 2026 - 18:18 cve.org

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

9 npm packages depend on js-yaml (7 direct, 2 indirect)

Ecosystem-wide dependent count for version 5.0.0.

DescriptionCVE.org

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2.

Articles & Coverage 1

News 7 New Node.js Vulnerabilities - 1 Critical, 6 High, 4 With POC Aug 14, 2026

AnalysisAI

Exponential parsing time in js-yaml 5.0.0 through 5.2.1 enables unauthenticated remote denial of service via a crafted YAML payload under 200 bytes. The parser's flow-collection logic re-parses nested flow-sequence keys rather than caching results, producing O(2^n) work per nesting level - approximately 30 levels suffices to stall a Node.js process for over two minutes on a single CPU. A functional proof-of-concept is published in the GHSA advisory; no special YAML features or non-default configuration options are required to trigger the flaw.

Technical ContextAI

The vulnerability resides in the readFlowCollection function within src/parser/parser.ts of js-yaml 5.x (CWE-407: Inefficient Algorithmic Complexity). When a flow-sequence entry is discovered to be a key:value pair, the parser calls restoreState to rewind and then invokes parseNode a second time to re-interpret the already-parsed entry as the key. If that key is itself a nested flow sequence of identical shape, the dual-parse recurses: each nesting level doubles the total work, yielding O(2^n) complexity. The YAML maxDepth guard (default 100) does not mitigate this because execution time becomes unmanageable at roughly 30-40 levels, far below the depth ceiling. The fix in commit 3e5240f9 introduces insertFlowPairMappingEvent, which injects a mapping event directly into the event list instead of rewinding and re-parsing, eliminating the exponential path entirely.

RemediationAI

Upgrade js-yaml to version 5.2.2, the vendor-released patch that resolves this issue via commit 3e5240f9cbe645ce5afb58524954a13c8539c853 (https://github.com/nodeca/js-yaml/commit/3e5240f9cbe645ce5afb58524954a13c8539c853). The vendor advisory is at https://github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5. If an immediate upgrade is not feasible, do not pass untrusted, externally-supplied content directly to load() or loadAll() without preprocessing - note that restricting payload size alone is insufficient since the exploit input is under 200 bytes. A targeted compensating control is to offload YAML parsing to a worker_threads Worker with a hard timeout so that a stalled parse cannot block the main event loop; this adds implementation complexity but prevents process-wide availability loss. Schema-level allowlisting of permitted YAML constructs (rejecting flow collections from untrusted input) would eliminate the vulnerable code path without requiring an upgrade.

More in Node.js

View all

CVE-2024-41713 CRITICAL Emergency POC

9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could

CVE-2024-55591 CRITICAL Emergency POC

9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote

CVE-2023-44487 HIGH Act Now POC

7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2014-7205 CRITICAL Act Now POC

10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t

CVE-2025-59528 CRITICAL Act Now POC

10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete

CVE-2017-14849 HIGH Act Now POC

7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc

CVE-2017-5941 CRITICAL Emergency POC

9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2014-3744 HIGH Act Now POC

7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi

CVE-2014-9566 HIGH Act Now POC

7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin

CVE-2013-4660 MEDIUM This Month POC

6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

CVE-2016-2107 MEDIUM This Month POC

5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-407 – Inefficient Algorithmic Complexity

View all

CVE-2026-90776 HIGH POC

8.7

CVE-2026-59094 HIGH POC

8.7

CVE-2026-54284 HIGH POC

8.7

CVE-2026-71321 HIGH POC

7.5

CVE-2026-59887 HIGH POC

7.5

CVE-2026-59870 HIGH POC

7.5

CVE-2024-9631 HIGH POC

7.5

CVE-2026-27903 HIGH POC

7.5

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Performance Computing 12	Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Not-Affected

CVE-2026-73643 vulnerability details – vuln.today

Back

js-yaml CVE-2026-73643

Severity by source

CVSS VectorVendor: github

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

Articles & Coverage 1

AnalysisAI

Technical ContextAI

RemediationAI

More in Node.js

Same weakness CWE-407 – Inefficient Algorithmic Complexity

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code