{"id":"CVE-2026-53550","revision":"e68e29dbb87944e78a636b8e7cd34114","records":[{"revision":"e68e29dbb87944e78a636b8e7cd34114","observedAt":"2026-10-25T13:17:16.273+00:00","statement":{"source":"nvd","id":"CVE-2026-53550","aliases":[],"title":"js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This …","description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.","state":0,"publishedAt":"2026-06-22T16:16:38.447+00:00","modifiedAt":"2026-07-09T20:33:57.993+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53550","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-407"],"productCriteria":["cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-06-22T16:16:38.447","lastModified":"2026-07-09T20:33:57.993"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-53550","identifiers":["CVE-2026-53550"]},"retained":false,"historicalAffected":[]}],"coverage":[]}