Skip to content
Fencer Vulns
medium 5.3

CVE-2026-53550 json

js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases

published 2026-06-15 4 mo ago modified 2026-10-25 14 d ago also GHSA-h67p-54hq-rp68 , EUVD-2026-38256

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 36%
public exploits
0
none known

Summary

js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.

Patch / fix

  • npm js-yaml 3.15.0, 4.2.0
  • nodeca js-yaml 3.15.0, 4.2.0
  • node-js-yaml Debian 14 4.2.0+~4.0.9-1

debian advisories DEBIAN-CVE-2026-53550

  • nodejs24 hummingbird 1 24.18.0-0.3.hum1
  • nodejs24-bin hummingbird 1 24.18.0-0.3.hum1
  • nodejs24-npm hummingbird 1 11.16.0-1.24.18.0.0.3.hum1
  • nodejs24-libs hummingbird 1 24.18.0-0.3.hum1
  • nodejs24-npm-bin hummingbird 1 24.18.0-0.3.hum1
  • nodejs24-full-i18n hummingbird 1 24.18.0-0.3.hum1
  • nodejs25 hummingbird 1 25.9.0-1.3.hum1
  • nodejs25-bin hummingbird 1 25.9.0-1.3.hum1

red hat advisories RHSA-2026:38236RHSA-2026:37534RHSA-2026:33866

  • velociraptor openSUSE Tumbleweed 0.76.7.0.git145.b60ef1146-1.1
  • agama-web-ui openSUSE Tumbleweed 24+0.a836cced5-52.1
  • agama-integration-tests openSUSE Tumbleweed 1785848065.5562c7c-4.1
  • agama-web-ui openSUSE Leap 16.0 17+673.b97ba64d6-160000.12.1
  • python-pytest-html openSUSE Leap 16.0 4.1.1-bp160.3.1
  • python-pydata-sphinx-theme openSUSE Tumbleweed 0.19.0-1.1
  • python-pytest-html openSUSE Tumbleweed 4.2.0-3.1

opensuse advisories openSUSE-SU-2026:12070-1openSUSE-SU-2026:11680-1openSUSE-SU-2026:11452-1openSUSE-SU-2026:21448-1openSUSE-SU-2026:21176-1openSUSE-SU-2026:11148-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-53550 updated cvss 5.3

js-yaml: js-yaml: Denial of Service via crafted YAML merge keys

  • Red Hat Cryostat 4 js-yaml, grafana-infinity-datasource-npm, cryostat-openshift-console-plugin-npm, cryostat/cryostat-openshift-console-plugin-rhel9 Red Hat Migration Toolkit for Applications 8 mta/mta-ui-rhel8, mta/mta-ui-rhel9 Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-ui-rhel8 Red Hat Multicluster Engine for Kubernetes multicluster-engine/console-mce-rhel9 Red Hat Network Observability Operator network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-console-plugin-pf5-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8, workload-availability/node-remediation-console-rhel9, workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9
    +25 more products
    Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-console-plugin-pf5-rhel9 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8, openshift-service-mesh/kiali-ossmc-rhel8 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9, openshift-service-mesh/kiali-ossmc-rhel9, openshift-service-mesh/kiali-rhel9-operator, openshift-service-mesh/kiali-operator-bundle Red Hat 3scale API Management Platform 2 3scale-amp21/system, 3scale-amp22/system, 3scale-amp2/system-rhel7, 3scale-amp2/system-rhel8, 3scale-amp2/system-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel9 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-main-rhel9 Red Hat AMQ Broker 7 js-yaml Red Hat Ansible Automation Platform 2 automation-gateway, automation-controller, automation-platform-ui, automation-eda-controller, ansible-automation-platform-26/gateway-rhel9, ansible-automation-platform-27/gateway-rhel9, +6 more Red Hat build of Apache Camel - HawtIO 4 js-yaml Red Hat build of Apache Camel for Spring Boot 4 js-yaml Red Hat build of Apicurio Registry 3 apicurio/apicurio-registry-ui-rhel8, apicurio/apicurio-registry-ui-rhel9 Red Hat Build of Keycloak js-yaml Red Hat Build of Podman Desktop rh-podman-desktop.git Red Hat Ceph Storage 9 rhceph/alloy-rhel10 Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9 Red Hat Data Grid 8 js-yaml Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Directory Server 11 389-ds-base Red Hat Directory Server 12 389-ds-base Red Hat Discovery 2 discovery/discovery-ui-rhel9 Red Hat Edge Manager 1 rhem/flightctl-ui-rhel9, rhem/flightctl-ui-rhel10, rhem/flightctl-ui-ocp-rhel9, rhem/flightctl-ui-ocp-rhel10 Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +8 more Red Hat Enterprise Linux 9 grafana, grafana-selinux Red Hat Enterprise Linux 10 grafana
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rust, rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Fuse 7 js-yaml
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images nodejs20
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 7 js-yaml Red Hat JBoss Enterprise Application Platform 8 js-yaml Red Hat JBoss Enterprise Application Platform Expansion Pack js-yaml Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-console-rhel9, openshift4/ose-monitoring-plugin-rhel8, openshift4/ose-monitoring-plugin-rhel9, openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 5 openshift5/ose-console-rhel9, openshift5/ose-monitoring-plugin-rhel9, openshift5/nmstate-console-plugin-rhel9, openshift5/ose-agent-installer-ui-rhel9 Red Hat OpenShift Dev Spaces devspaces/code-rhel9, devspaces/dashboard-rhel9
    affected: workaround, no fix available “Fix deferred”

10 more affected, 5 more fixed, 13 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.41% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
npm js-yaml
>=4.0.0, <4.2.0
<3.15.0
4.2.0
3.15.0

Affected products

  • nodeca js-yaml

Classification

Weakness
  • CWE-407 Inefficient Algorithmic Complexity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.