{"id":"CVE-2026-73643","sourceIdentifier":"security-advisories@github.com","published":"2026-08-13T18:18:19.947","lastModified":"2026-10-24T15:10:00.190","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2."},{"lang":"es","value":"js-yaml es un analizador y volcador YAML de JavaScript. Desde la versión 5.0.0 hasta la 5.2.2, el análisis de un documento YAML pequeño puede tomar tiempo exponencial cuando una aplicación llama a load() o loadAll() con una entrada no confiable. En src/parser/parser.ts, readFlowCollection utiliza restoreState y llama a parseNode una segunda vez cuando una entrada de secuencia de flujo se reconoce como un par clave: valor. Si la clave es una secuencia de flujo anidada de la misma forma, cada nivel se analiza dos veces, lo que provoca un trabajo de O(2^n) y permite que una entrada de menos de 200 bytes mantenga una CPU ocupada durante minutos, bloquee el bucle de eventos de Node.js y paralice el proceso. No se requieren anclas, alias, fusiones, etiquetas ni opciones no predeterminadas. Este problema se ha corregido en la versión 5.2.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"nodeca","product":"js-yaml","versions":[{"version":">= 5.0.0, < 5.2.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-14T16:43:36.799144Z","id":"CVE-2026-73643","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-407"}]}],"references":[{"url":"https://github.com/nodeca/js-yaml/commit/3e5240f9cbe645ce5afb58524954a13c8539c853","source":"security-advisories@github.com"},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5","source":"security-advisories@github.com"},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}