CVE-2026-53550 js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases
Attackers can cause denial of service in applications using js-yaml by submitting crafted YAML documents that trigger quadratic CPU exhaustion during merge key processing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53550?
CVE-2026-53550 is a medium-severity denial of service vulnerability in nodeca js-yaml, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.
Weakness: CWE-407
Which versions are affected by CVE-2026-53550?
4 open source packages ship an affected version, including js-yaml. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
js-yaml npm | All versions | 3.15.0 |
js-yaml npm | All versions | 3.15.0 |
js-yaml npm | From 4.0.0 | 4.2.0 |
js-yaml npm | From 4.0.0 | 4.2.0 |
Linux distribution packages (1)
python-pydata-sphinx-theme openSUSE:Tumbleweed | All versions | 0.19.0-1.1 |
Products include Nodeca Js-Yaml.
How do I fix CVE-2026-53550?
Upgrade js-yaml to a fixed version for your release line: 3.15.0 or 4.2.0.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-53550 being exploited?
There is no known exploitation of CVE-2026-53550 in the wild and no public exploit code.
Other vulnerabilities in nodeca js-yaml
- CVE-2026-59869 js-yaml: YAML merge-key chains can force quadratic CPU consumption
- CVE-2026-59870 js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing
- CVE-2013-4660 Deserialization Code Execution in js-yaml
- CVE-2026-59868 js-yaml: YAML merge-key chains can force quadratic CPU consumption
- CVE-2025-64718 js-yaml has prototype pollution in merge (<<)
Sources
Also known as CLEANSTART-2026-EU49619, CLEANSTART-2026-RB45819, CLEANSTART-2026-ZI17820, CLEANSTART-2026-ZU44577, CLSA-2026-1790186133, CLSA-2026-1790944130 and 41 more.