CVE-2026-53550

{
  "id": "CVE-2026-53550",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-22T16:16:38.447",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0."
    },
    {
      "lang": "es",
      "value": "js-yaml es un analizador y volcador YAML de JavaScript. Antes de 4.2.0 y 3.15.0, un documento YAML manipulado puede desencadenar un agotamiento algorítmico de la CPU en el procesamiento de claves de fusión (<<) de js-yaml al repetir el mismo alias muchas veces en una secuencia de fusión. Esto causa un comportamiento cuadrático en tiempo de análisis en relación con el tamaño de la entrada y puede bloquear un worker/bucle de eventos de Node.js durante segundos con una carga útil relativamente pequeña (decenas de KB), resultando en denegación de servicio. El problema está en el manejo de fusiones dentro de lib/loader.js. Esta vulnerabilidad está corregida en 4.2.0 y 3.15.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "nodeca",
          "product": "js-yaml",
          "versions": [
            {
              "version": ">= 4.0.0, < 4.2.0",
              "status": "affected"
            },
            {
              "version": "< 3.15.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-23T16:05:40.611324Z",
          "id": "CVE-2026-53550",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-407"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:node.js:*:*",
              "versionEndExcluding": "3.15.0",
              "matchCriteriaId": "6BA37F36-3871-48AF-97FA-C3EFA44746C9"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:node.js:*:*",
              "versionStartIncluding": "4.0.0",
              "versionEndExcluding": "4.2.0",
              "matchCriteriaId": "0CB244DD-6149-4E5B-A950-10C4FE3484CD"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}