{"id":"CVE-2026-53550","revision":null,"records":[{"revision":"1d906a8f93144f44b1dbfcf0db213eb5","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-53550","aliases":[],"title":"js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases","description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.","state":0,"publishedAt":"2026-06-22T14:59:14.906+00:00","modifiedAt":"2026-06-29T15:06:58.346+00:00","affected":[{"ecosystem":"Vendor product","name":"js-yaml","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"nodeca\",\n                    \"product\": \"js-yaml\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 4.0.0, < 4.2.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"< 3.15.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53550","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-53550","identifiers":["CVE-2026-53550"]},"retained":false,"historicalAffected":[]},{"revision":"2978704f2fff4b37aba316bd266d1cf7","observedAt":"2026-11-07T11:37:46.138+00:00","statement":{"source":"euvd","id":"EUVD-2026-38256","aliases":["CVE-2026-53550","GHSA-h67p-54hq-rp68"],"title":"js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This …","description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":null}],"references":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38256","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 22, 2026, 2:59:14 PM","dateUpdated":"Jun 29, 2026, 3:06:58 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2026:21448-1","title":"Security update for agama-web-ui","vulnerabilityIds":["CVE-2025-7783","CVE-2026-12143","CVE-2026-13149","CVE-2026-13311","CVE-2026-13676","CVE-2026-27601","CVE-2026-40181","CVE-2026-49356","CVE-2026-53550","CVE-2026-53632","CVE-2026-54466","CVE-2026-54490","CVE-2026-55602"]},{"id":"openSUSE-SU-2026:11452-1","title":"agama-integration-tests-1785848065.5562c7c-4.1 on GA media","vulnerabilityIds":["CVE-2026-13149","CVE-2026-27699","CVE-2026-48779","CVE-2026-53550"]},{"id":"openSUSE-SU-2026:11149-1","title":"python311-pytest-html-4.2.0-3.1 on GA media","vulnerabilityIds":["CVE-2026-13311","CVE-2026-53550"]},{"id":"openSUSE-SU-2026:11680-1","title":"agama-web-ui-24+0.a836cced5-52.1 on GA media","vulnerabilityIds":["CVE-2025-7783","CVE-2026-13149","CVE-2026-13676","CVE-2026-33245","CVE-2026-49356","CVE-2026-53550","CVE-2026-53632","CVE-2026-54466","CVE-2026-55602","CVE-2026-67313","CVE-2026-67315","CVE-2026-67317","CVE-2026-67319","CVE-2026-67321","CVE-2026-69153","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089","CVE-2026-73650"]},{"id":"openSUSE-SU-2026:21176-1","title":"Security update for python-pytest-html","vulnerabilityIds":["CVE-2026-13311","CVE-2026-53550"]},{"id":"RHSA-2026:38236","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-5078","CVE-2026-6733","CVE-2026-6734","CVE-2026-9678","CVE-2026-9679","CVE-2026-9697","CVE-2026-11525","CVE-2026-12151","CVE-2026-53550","CVE-2026-59869"]},{"id":"RHSA-2026:37534","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-53550","CVE-2026-59869"]},{"id":"RHSA-2026:73987","title":"Red Hat Security Advisory: RHOAI 3.3.7 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-61726","CVE-2025-66471","CVE-2025-71408","CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-5422","CVE-2026-6321","CVE-2026-6734","CVE-2026-9697","CVE-2026-11816","CVE-2026-11822","CVE-2026-11824","CVE-2026-12151","CVE-2026-13149","CVE-2026-15154","CVE-2026-15378","CVE-2026-16221","CVE-2026-16745","CVE-2026-18951","CVE-2026-23490","CVE-2026-25681","CVE-2026-27136","CVE-2026-27489","CVE-2026-27893","CVE-2026-28356","CVE-2026-28500","CVE-2026-28684","CVE-2026-31230","CVE-2026-31958","CVE-2026-32274","CVE-2026-32286","CVE-2026-32597","CVE-2026-33186","CVE-2026-33231","CVE-2026-33245","CVE-2026-33811","CVE-2026-33814","CVE-2026-33815","CVE-2026-33816","CVE-2026-34445","CVE-2026-34986","CVE-2026-34993","CVE-2026-35397","CVE-2026-35536","CVE-2026-39821","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39835","CVE-2026-40110","CVE-2026-41242","CVE-2026-42215","CVE-2026-42294","CVE-2026-42296","CVE-2026-42297","CVE-2026-42338","CVE-2026-42502","CVE-2026-42508","CVE-2026-44240","CVE-2026-44431","CVE-2026-44432","CVE-2026-44727","CVE-2026-44843","CVE-2026-45736","CVE-2026-46595","CVE-2026-48526","CVE-2026-48586","CVE-2026-48710","CVE-2026-48746","CVE-2026-48779","CVE-2026-49855","CVE-2026-53550","CVE-2026-54058","CVE-2026-54283","CVE-2026-55969","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-59197","CVE-2026-59199","CVE-2026-59200","CVE-2026-59204","CVE-2026-59205","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59884","CVE-2026-59885","CVE-2026-59886","CVE-2026-62384","CVE-2026-63310","CVE-2026-64834","CVE-2026-64835","CVE-2026-66036","CVE-2026-66037","CVE-2026-66038","CVE-2026-66040","CVE-2026-67322","CVE-2026-67323","CVE-2026-67325","CVE-2026-68770","CVE-2026-69152","CVE-2026-69192","CVE-2026-69243","CVE-2026-69244","CVE-2026-71281","CVE-2026-73089","CVE-2026-73415","CVE-2026-73417","CVE-2026-73627","CVE-2026-78682","CVE-2026-79674","CVE-2026-79675","CVE-2026-80205","CVE-2026-81722","CVE-2026-81724","CVE-2026-81727","CVE-2026-84375","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:12070-1","title":"velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media","vulnerabilityIds":["CVE-2025-0914","CVE-2026-12143","CVE-2026-14257","CVE-2026-17535","CVE-2026-18348","CVE-2026-18636","CVE-2026-18638","CVE-2026-18639","CVE-2026-18860","CVE-2026-27601","CVE-2026-29074","CVE-2026-41650","CVE-2026-45623","CVE-2026-49356","CVE-2026-5329","CVE-2026-53550","CVE-2026-55602","CVE-2026-56852","CVE-2026-59869","CVE-2026-6290","CVE-2026-64951","CVE-2026-64952","CVE-2026-64954","CVE-2026-65903","CVE-2026-65912","CVE-2026-65913","CVE-2026-65914","CVE-2026-67314","CVE-2026-67320","CVE-2026-6863","CVE-2026-69152","CVE-2026-69153","CVE-2026-6948","CVE-2026-73086","CVE-2026-73646","CVE-2026-73650","CVE-2026-7572","CVE-2026-7573","CVE-2026-84369","CVE-2026-84370"]},{"id":"RHSA-2026:33866","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-13149","CVE-2026-48619","CVE-2026-48928","CVE-2026-48930","CVE-2026-48934","CVE-2026-48935","CVE-2026-48936","CVE-2026-53550","CVE-2026-59868","CVE-2026-59870"]},{"id":"RHSA-2026:60520","title":"Red Hat Security Advisory: RHOAI 3.4.4 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-66471","CVE-2025-66626","CVE-2025-71329","CVE-2025-71330","CVE-2026-0545","CVE-2026-2614","CVE-2026-5241","CVE-2026-5422","CVE-2026-6322","CVE-2026-6734","CVE-2026-8643","CVE-2026-9697","CVE-2026-12143","CVE-2026-12151","CVE-2026-12243","CVE-2026-12481","CVE-2026-13149","CVE-2026-13311","CVE-2026-13676","CVE-2026-13717","CVE-2026-14450","CVE-2026-15154","CVE-2026-15218","CVE-2026-15378","CVE-2026-15467","CVE-2026-15581","CVE-2026-16745","CVE-2026-18608","CVE-2026-18611","CVE-2026-18617","CVE-2026-18620","CVE-2026-18621","CVE-2026-18948","CVE-2026-18951","CVE-2026-18982","CVE-2026-25681","CVE-2026-27136","CVE-2026-32280","CVE-2026-32283","CVE-2026-33079","CVE-2026-33245","CVE-2026-33811","CVE-2026-33814","CVE-2026-34993","CVE-2026-35397","CVE-2026-39820","CVE-2026-39821","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39835","CVE-2026-40171","CVE-2026-41672","CVE-2026-41673","CVE-2026-41675","CVE-2026-42211","CVE-2026-42215","CVE-2026-42264","CVE-2026-42266","CVE-2026-42284","CVE-2026-42305","CVE-2026-42311","CVE-2026-42338","CVE-2026-42342","CVE-2026-42499","CVE-2026-42502","CVE-2026-42508","CVE-2026-42557","CVE-2026-44017","CVE-2026-44018","CVE-2026-44020","CVE-2026-44240","CVE-2026-44244","CVE-2026-44289","CVE-2026-44290","CVE-2026-44291","CVE-2026-44292","CVE-2026-44293","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44513","CVE-2026-44660","CVE-2026-44705","CVE-2026-44724","CVE-2026-44727","CVE-2026-44827","CVE-2026-44843","CVE-2026-45292","CVE-2026-45623","CVE-2026-45736","CVE-2026-45740","CVE-2026-45804","CVE-2026-46595","CVE-2026-46597","CVE-2026-46625","CVE-2026-47214","CVE-2026-48526","CVE-2026-48710","CVE-2026-48712","CVE-2026-48779","CVE-2026-48801","CVE-2026-49476","CVE-2026-49477","CVE-2026-49851","CVE-2026-49978","CVE-2026-50193","CVE-2026-53550","CVE-2026-54058","CVE-2026-54060","CVE-2026-54283","CVE-2026-54293","CVE-2026-55379","CVE-2026-55380","CVE-2026-55685","CVE-2026-56121","CVE-2026-56208","CVE-2026-56209","CVE-2026-56210","CVE-2026-56211","CVE-2026-58049","CVE-2026-59197","CVE-2026-59199","CVE-2026-59200","CVE-2026-59204","CVE-2026-59205","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59884","CVE-2026-59885","CVE-2026-59886","CVE-2026-64835","CVE-2026-64849","CVE-2026-69152","CVE-2026-69192","CVE-2026-69243","CVE-2026-69244"]},{"id":"openSUSE-SU-2026:11148-1","title":"python311-pydata-sphinx-theme-0.19.0-1.1 on GA media","vulnerabilityIds":["CVE-2026-53550"]},{"id":"RHSA-2026:65126","title":"Red Hat Security Advisory: RHOAI 2.25.11 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-61729","CVE-2025-67030","CVE-2026-4926","CVE-2026-6734","CVE-2026-9563","CVE-2026-9697","CVE-2026-12151","CVE-2026-12243","CVE-2026-13149","CVE-2026-15075","CVE-2026-15154","CVE-2026-15378","CVE-2026-15581","CVE-2026-16745","CVE-2026-18608","CVE-2026-18611","CVE-2026-18617","CVE-2026-18620","CVE-2026-18621","CVE-2026-25681","CVE-2026-26996","CVE-2026-27136","CVE-2026-27904","CVE-2026-30922","CVE-2026-32283","CVE-2026-33231","CVE-2026-33810","CVE-2026-33811","CVE-2026-33814","CVE-2026-33870","CVE-2026-33871","CVE-2026-34445","CVE-2026-35536","CVE-2026-39821","CVE-2026-39829","CVE-2026-39835","CVE-2026-40171","CVE-2026-40192","CVE-2026-40895","CVE-2026-41178","CVE-2026-42027","CVE-2026-42215","CVE-2026-42284","CVE-2026-42338","CVE-2026-42502","CVE-2026-42508","CVE-2026-42578","CVE-2026-42579","CVE-2026-42581","CVE-2026-42583","CVE-2026-42584","CVE-2026-42587","CVE-2026-44240","CVE-2026-44244","CVE-2026-44249","CVE-2026-44431","CVE-2026-44893","CVE-2026-45112","CVE-2026-45416","CVE-2026-45623","CVE-2026-45674","CVE-2026-45736","CVE-2026-45819","CVE-2026-47691","CVE-2026-48043","CVE-2026-48059","CVE-2026-48586","CVE-2026-48779","CVE-2026-49978","CVE-2026-50010","CVE-2026-50193","CVE-2026-53550","CVE-2026-54293","CVE-2026-54512","CVE-2026-55685","CVE-2026-55831","CVE-2026-55833","CVE-2026-55851","CVE-2026-56745","CVE-2026-56746","CVE-2026-56819","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59885","CVE-2026-59899","CVE-2026-66036","CVE-2026-66039","CVE-2026-67313","CVE-2026-67320","CVE-2026-67322","CVE-2026-67323","CVE-2026-67324","CVE-2026-67325","CVE-2026-68494","CVE-2026-69112","CVE-2026-69152","CVE-2026-69192","CVE-2026-69243","CVE-2026-69244","CVE-2026-71281","CVE-2026-73088","CVE-2026-73089","CVE-2026-73415","CVE-2026-73417","CVE-2026-73566","CVE-2026-73622","CVE-2026-73623","CVE-2026-73624","CVE-2026-73625","CVE-2026-73627","CVE-2026-73643"]},{"id":"WID-SEC-W-2026-2618","title":"IBM App Connect Enterprise: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-11525","CVE-2026-12151","CVE-2026-13676","CVE-2026-53550","CVE-2026-54285","CVE-2026-59869","CVE-2026-59877","CVE-2026-6733","CVE-2026-6734","CVE-2026-9675","CVE-2026-9678","CVE-2026-9679","CVE-2026-9697"]},{"id":"RHSA-2026:56431","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update","vulnerabilityIds":["CVE-2025-61726","CVE-2025-61729","CVE-2025-64718","CVE-2025-68470","CVE-2026-1525","CVE-2026-1526","CVE-2026-1527","CVE-2026-2229","CVE-2026-6321","CVE-2026-6322","CVE-2026-6733","CVE-2026-6734","CVE-2026-9358","CVE-2026-9679","CVE-2026-9697","CVE-2026-11525","CVE-2026-12143","CVE-2026-12151","CVE-2026-13149","CVE-2026-13676","CVE-2026-22036","CVE-2026-25645","CVE-2026-33186","CVE-2026-33349","CVE-2026-33671","CVE-2026-33672","CVE-2026-33750","CVE-2026-34043","CVE-2026-34986","CVE-2026-35469","CVE-2026-39821","CVE-2026-40181","CVE-2026-41305","CVE-2026-41650","CVE-2026-41907","CVE-2026-42342","CVE-2026-45409","CVE-2026-45736","CVE-2026-48779","CVE-2026-48801","CVE-2026-53550","CVE-2026-59869"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-38256","identifiers":["EUVD-2026-38256","CVE-2026-53550","GHSA-h67p-54hq-rp68"]},"retained":false,"historicalAffected":[]},{"revision":"e8b96d4f89494a6297e3a5411cd57daf","observedAt":"2026-10-27T14:13:22.737+00:00","statement":{"source":"nvd","id":"CVE-2026-53550","aliases":[],"title":"js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This …","description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.","state":0,"publishedAt":"2026-06-22T16:16:38.447+00:00","modifiedAt":"2026-10-25T23:10:00.167+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53550","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-407"],"productCriteria":["cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-06-22T16:16:38.447","lastModified":"2026-10-25T23:10:00.167"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-53550","identifiers":["CVE-2026-53550"]},"retained":false,"historicalAffected":[]},{"revision":"72ad9a3196e24f0f92dce70d93014ad4","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-h67p-54hq-rp68","aliases":["CVE-2026-53550"],"title":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","description":"### Summary\nA crafted YAML document can trigger algorithmic CPU exhaustion in `js-yaml` merge-key processing (`<<`) by repeating the same alias many times in a merge sequence.  \nThis causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service.\n\n### Details\nThe issue is in merge handling inside `lib/loader.js`:\n\n- `storeMappingPair(...)` iterates every element of a merge sequence when key tag is `tag:yaml.org,2002:merge`.\n- For each element, it calls `mergeMappings(...)`.\n- `mergeMappings(...)` computes `Object.keys(source)` and performs `_hasOwnProperty.call(destination, key)` checks for each key.\n\nWhen input is of the form:\n\na: &a {k0:0, k1:0, ..., kK:0}\nb: {<<: [*a, *a, *a, ... repeated M times ...]}\nall *a entries refer to the same anchored object. After the first merge, subsequent merges are semantically no-ops, but the parser still reprocesses all keys each time.\nResulting work is O(K * M), while input size is O(K + M), giving quadratic scaling as payload grows.\nRelevant code path:\nlib/loader.js in storeMappingPair(...) merge branch (keyTag === 'tag:yaml.org,2002:merge')\nlib/loader.js mergeMappings(...)\n\n\n### Root cause\nFile:       lib/loader.js\nFunction:   storeMappingPair(state, _result, overridableKeys, keyTag, keyNode,\n                             valueNode, startLine, startLineStart, startPos)\nLines:      ~359-366\n\n    if (keyTag === 'tag:yaml.org,2002:merge') {\n      if (Array.isArray(valueNode)) {\n        for (index = 0, quantity = valueNode.length; index < quantity; index += 1) {\n          mergeMappings(state, _result, valueNode[index], overridableKeys);\n        }\n      } else {\n        mergeMappings(state, _result, valueNode, overridableKeys);\n      }\n    }\n\nWhen the merge value is a sequence (YAML 1.1 <<: [ *a, *a, ... ]), each element\nis handed to mergeMappings() without deduplication. mergeMappings() then does\n\n    sourceKeys = Object.keys(source);\n    for (index = 0; index < sourceKeys.length; index += 1) {\n      key = sourceKeys[index];\n      if (!_hasOwnProperty.call(destination, key)) {\n        setProperty(destination, key, source[key]);\n        overridableKeys[key] = true;\n      }\n    }\n\nEvery alias reference in the sequence resolves (by design) to the SAME object\nvia state.anchorMap. After the first merge, every subsequent merge of that same\nreference is a pure no-op semantically, but still performs:\n\n  * one Object.keys(source) call (O(K))\n  * K _hasOwnProperty.call checks on the destination\n\nTotal: M * K hasOwnProperty checks + M Object.keys allocations, while the final\nobject and all observable side effects are identical to a single merge.\n\nYAML semantics for `<<:` are idempotent and commutative over duplicate sources,\nso collapsing duplicates preserves behavior exactly; this isn't a spec trade-off.\n\n\n### PoC\nEnvironment:\njs-yaml version: 4.1.1\nNode.js: v24.5.0\nPlatform: arm64 macOS (reproduced consistently)\nReproduction script:\nCreate many keys in one anchored map (&a).\nMerge that same alias repeatedly via <<: [*a, *a, ...].\nMeasure parse time and compare with control payload using single merge (<<: *a).\nObserved repeated runs (same machine):\nK=M=1000, input 9,909 bytes: ~33–36 ms\nK=M=2000, input 20,909 bytes: ~121–123 ms\nK=M=4000, input 42,909 bytes: ~524–537 ms\nK=M=6000, input 64,909 bytes: ~1,608–1,829 ms\nK=M=8000, input 86,909 bytes: ~3,395–3,565 ms\nControl (single merge, similar key counts):\nK=2000: ~1–2 ms\nK=4000: ~3 ms\nK=8000: ~5 ms\nAlso verified: repeated-merge output equals single-merge output (same key count and same JSON), confirming excess time is redundant computation.\n\n\n### Impact\nThis is a denial-of-service vulnerability (CPU exhaustion / algorithmic complexity).\nAny service parsing untrusted YAML with js-yaml can be impacted, including API backends, CI tools, config processors, and automation services. An attacker can submit crafted YAML to significantly increase CPU time and reduce availability.\n\n### Suggested fix:\nDedupe the merge source list by reference before invoking mergeMappings. Any of\nthe following are minimal and preserve YAML 1.1 merge semantics:\n\ndedupe in storeMappingPair:\n\n    if (keyTag === 'tag:yaml.org,2002:merge') {\n      if (Array.isArray(valueNode)) {\n        var seen = new Set();\n        for (index = 0, quantity = valueNode.length; index < quantity; index += 1) {\n          var src = valueNode[index];\n          if (seen.has(src)) continue;   // idempotent; skip redundant alias\n          seen.add(src);\n          mergeMappings(state, _result, src, overridableKeys);\n        }\n      } else {\n        mergeMappings(state, _result, valueNode, overridableKeys);\n      }\n    }","state":0,"publishedAt":"2026-06-15T17:15:07+00:00","modifiedAt":"2026-09-10T03:50:49.7299239+00:00","affected":[{"ecosystem":"npm","name":"js-yaml","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.2.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"js-yaml","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.15.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68","https://nvd.nist.gov/vuln/detail/CVE-2026-53550","https://github.com/nodeca/js-yaml"],"sourceUrl":"https://github.com/advisories/GHSA-h67p-54hq-rp68","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-h67p-54hq-rp68","identifiers":["GHSA-h67p-54hq-rp68","CVE-2026-53550"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T20:07:23.8593986+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T20:07:23.8593986+00:00","lastSuccessAt":"2026-11-07T20:07:24.014368+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:24.014369+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-aac6631b84e101279eb6b1c3835f52bf7b26c50f4d25bc0fb35977235593f4a7","complete":true,"records":420943,"lastAttemptAt":"2026-11-07T20:07:23.1739993+00:00","lastSuccessAt":"2026-11-07T20:07:23.0712879+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:23.1739993+00:00","snapshotPublishedAt":"2026-11-07T19:18:33+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c5a2504558b549559b8658a653596391","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T20:19:26.3099435+00:00","lastSuccessAt":"2026-11-07T20:19:26.304+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:19:26.304+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T20:07:23.8593986+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T20:07:23.8593986+00:00","lastSuccessAt":"2026-11-07T20:07:24.0152025+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:24.0152028+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-191690d52ba04a91b1a2749fa6191ceb","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T20:07:42.8841875+00:00","lastSuccessAt":"2026-11-07T20:07:42.881+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:42.881+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T20:07:23.800032+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:23.800032+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T20:07:23.2420378+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:23.2420378+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T20:07:23.8227715+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:23.8227715+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T20:07:23.4659623+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:23.4659623+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}