CVE catalog
CVE-2026-73643
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.49% · Oct 25, 2026
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | node-js-yaml | sid | 4.3.2+~4.0.9-1 | not affected |
| Debian | node-js-yaml | forky | 4.3.2+~4.0.9-1 | not affected |
| Debian | node-js-yaml | trixie | 4.1.0+dfsg+~4.0.5-7 | not affected |
| Debian | node-js-yaml | bookworm | 4.1.0+dfsg+~4.0.5-7 | not affected |
| Npm | js-yaml | Not reported | 5.2.2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | node-js-yaml | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | node-js-yaml | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | node-js-yaml | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | node-js-yaml | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Npm | js-yaml | npm | Not reported | 5.2.2 | Not reported | GHSA-PM4M-PH32-GHV5 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [node-js-yaml]Not affected
Details (2)
4.1.0+dfsg+~4.0.5-7· all · bookwormNot affected
nvd · node-js-yaml · debian · bookworm
4.1.0+dfsg+~4.0.5-7· all · bookwormNot affected
nvd · node-js-yaml · debian · bookworm
Observed:
References
- [https://ftp.suse.com/pub/projects/security/]
- [https://github.com/advisories/GHSA-pm4m-ph32-ghv5]
- [https://github.com/nodeca/js-yaml/commit/3e5240f9cbe645ce5afb58524954a13c8539c853]
- [https://github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-73643]
- [https://security-tracker.debian.org/tracker/CVE-2026-73643]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73643.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3221.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]