CVE-2026-33532: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33532 is a stack overflow (Denial of Service) vulnerability in the eemeli/yaml npm library caused by uncontrolled recursion during the node composition/resolution phase of YAML parsing. It affects yaml versions 1.0.0–1.10.2 and 2.0.0–2.8.2 for Node.js. The vulnerability was disclosed by the library maintainer on March 23, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory).

The root cause is CWE-674 (Uncontrolled Recursion): the compose/resolve phase of the yaml library uses recursive function calls with no depth bound, while the CST Parser phase uses a safe iterative stack-based approach and is unaffected. An attacker supplying crafted YAML input with deeply nested flow sequences (e.g., [.repeat(5000) + 1 + ].repeat(5000)) can exhaust the Node.js call stack with a payload as small as 2–10 KB, triggering a RangeError: Maximum call stack size exceeded. Critically, this RangeError is not a YAMLParseError, so applications that only catch YAML-specific errors will encounter an unhandled exception, potentially crashing the Node.js process. All three public parsing APIs — YAML.parse(), YAML.parseDocument(), and YAML.parseAllDocuments() — are affected (GitHub Advisory, Security Advisory).

Successful exploitation results in a Denial of Service: the crafted YAML payload can either fail individual requests or terminate the entire Node.js process, depending on the host application's exception handling. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Downstream IBM products incorporating the vulnerable library (including IBM App Connect Enterprise, IBM Security QRadar EDR, IBM Maximo Application Suite, IBM Guardium Data Security Center, and IBM Cloud Pak for Integration) are also affected (IBM ACE Advisory, IBM QRadar Advisory).

No confirmed in-the-wild exploitation has been reported, and no functional weaponized exploit is publicly available. A GitHub repository (danwulff/astro_CVE-2026-33532) was flagged as a potential PoC but was assessed as a generic Astro template with no exploit-specific content. The official security advisory includes a proof-of-concept code snippet demonstrating the crash locally, but it requires a victim application that parses attacker-supplied YAML. The EPSS score is approximately 0.044% (7th percentile), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Identify target: Find a Node.js application that accepts user-supplied YAML input and passes it to YAML.parse(), YAML.parseDocument(), or YAML.parseAllDocuments() from the yaml npm package (versions 1.0.0–1.10.2 or 2.0.0–2.8.2).
2. Craft payload: Generate a deeply nested YAML flow sequence payload — approximately 1,000–5,000 levels of nesting suffices. Example: '['.repeat(5000) + '1' + ']'.repeat(5000) (~10 KB).
3. Submit payload: Deliver the crafted YAML to the application via any input vector that triggers YAML parsing (e.g., HTTP request body, file upload, API parameter).
4. Trigger stack overflow: The compose/resolve phase recursively processes each nesting level without a depth bound, exhausting the Node.js call stack and throwing a RangeError: Maximum call stack size exceeded.
5. Achieve DoS: If the application only catches YAMLParseError (not generic Error or RangeError), the unhandled exception crashes the request handler or terminates the Node.js process entirely (Security Advisory).

• Logs: Node.js process logs or application error logs showing RangeError: Maximum call stack size exceeded originating from the yaml library's compose/resolve stack frames (e.g., composeNode, composeCollection).
• Application Behavior: Sudden request failures or process crashes correlated with YAML parsing operations; repeated HTTP 500 errors or service restarts on endpoints that accept YAML input.
• Network: Repeated small HTTP requests (~2–10 KB) to YAML-parsing endpoints containing payloads with long sequences of [ and ] characters.

The primary remediation is to upgrade the yaml npm package to version 2.8.3 (for 2.x users) or 1.10.3 (for 1.x users), both released March 21–23, 2026. The fix wraps the recursive composeCollection call in a try/catch that converts stack overflow errors into a YAMLParseError with code RESOURCE_EXHAUSTION, allowing graceful handling (yaml v2.8.3 release, yaml v1.10.3 release). As a short-term workaround where upgrading is not immediately possible: implement input validation to reject YAML documents with excessive nesting depth before parsing, ensure application exception handlers catch generic Error/RangeError in addition to YAMLParseError, and consider increasing the Node.js stack size via --stack-size flag. IBM has issued product-specific advisories for affected products including App Connect Enterprise, QRadar, Maximo, and Cloud Pak for Integration (IBM ACE Advisory).

The vulnerability was responsibly disclosed by reporters kq5y and peaktwilight directly to the eemeli/yaml maintainer, who published the fix and advisory simultaneously on March 23, 2026. IBM issued multiple security bulletins across its product portfolio acknowledging the dependency on the vulnerable library, indicating broad enterprise awareness. No significant public controversy or notable researcher commentary beyond the official advisory has been observed (GitHub Advisory, IBM ACE Advisory).