CVE-2026-53550: 
JavaScript vulnerability analysis and mitigation

CVE-2026-53550 is a denial-of-service vulnerability in js-yaml, a JavaScript YAML parser and dumper, caused by quadratic algorithmic complexity in merge-key (<<) processing. A crafted YAML document that repeats the same alias many times in a merge sequence triggers O(K×M) CPU work while the input size is only O(K+M), allowing an attacker to block a Node.js worker/event loop for seconds with a payload of tens of kilobytes. Affected versions are js-yaml >= 4.0.0 and <= 4.1.1 (4.x branch) and all versions < 3.15.0 (3.x branch). The vulnerability was published by maintainer puzrin on May 31, 2026, and assigned CVE-2026-53550 with a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, js-yaml Advisory).

The root cause (CWE-407: Inefficient Algorithmic Complexity) lies in lib/loader.js within the storeMappingPair() function. When a YAML merge key (<<) references a sequence of aliases, the function iterates each element and calls mergeMappings() without deduplicating repeated references. Because all repeated aliases resolve to the same anchored object via state.anchorMap, each subsequent merge is semantically a no-op but still executes Object.keys(source) (O(K)) and K _hasOwnProperty.call checks against the destination — yielding O(K×M) total work for M repeated aliases of an anchor with K keys. No authentication or special privileges are required; any network-accessible endpoint that parses untrusted YAML is exploitable. A public PoC payload structure is documented in the official advisory (js-yaml Advisory).

Successful exploitation causes CPU exhaustion in the Node.js process parsing the crafted YAML, blocking the event loop for seconds per request. Benchmarks from the advisory show that an ~87 KB payload (K=M=8000) causes ~3.4–3.6 seconds of parse time versus ~5 ms for a legitimate equivalent document. There is no confidentiality or integrity impact; the vulnerability is limited to availability, but repeated submissions can sustain a denial-of-service condition against API backends, CI/CD pipelines, configuration processors, and automation services that accept untrusted YAML input (GitHub Advisory).

A proof-of-concept payload structure is publicly documented in the official GitHub Security Advisory, including concrete parameter values (K=M=1000 through 8000) and measured timing outcomes, making the vulnerability straightforward to reproduce (js-yaml Advisory). No authentication is required and attack complexity is low, making it automatable. The EPSS score is approximately 0.25% (17th percentile), and there is currently no evidence of in-the-wild exploitation or CISA KEV catalog inclusion. The vulnerability is detected by Qualys (ID: 5013820) and Nessus (ID: 322241).

1. Identify target: Locate a service that accepts untrusted YAML input and uses js-yaml versions >= 4.0.0 <= 4.1.1 or < 3.15.0 (e.g., an API endpoint, CI configuration upload, or config processor).
2. Craft the payload: Construct a YAML document with an anchored mapping containing K keys and a merge sequence repeating the same alias M times:

a: &a {k0: 0, k1: 0, ..., kK: 0}
b: {<<: [*a, *a, *a, ... repeated M times ...]}

3. Tune parameters: Select K and M values to achieve the desired blocking duration. For example, K=M=4000 produces a ~43 KB payload causing ~530 ms of parse time; K=M=8000 produces ~87 KB causing ~3.5 seconds of blocking per parse.
4. Submit the payload: Send the crafted YAML document to the target endpoint (e.g., via HTTP POST, file upload, or API call).
5. Repeat for sustained DoS: Submit the payload repeatedly to keep the Node.js event loop continuously blocked, preventing the service from handling legitimate requests (js-yaml Advisory).

• Network: Repeated HTTP requests to YAML-parsing endpoints with payloads in the tens-of-kilobytes range containing YAML merge key (<<) sequences; unusually high request rates to configuration or data-ingestion endpoints.
• Logs: Application logs showing abnormally long YAML parse durations (seconds instead of milliseconds); Node.js event loop lag warnings or timeout errors coinciding with YAML parsing operations; repeated requests from the same source IP to YAML-accepting endpoints.
• Process: Node.js process showing sustained high CPU utilization (near 100% on a single core) during or after YAML parsing; event loop blocked warnings in Node.js APM or monitoring tools.
• File System: If YAML payloads are written to disk before parsing, presence of files containing patterns like <<: [*a, *a, *a, ...] with many repeated alias references (js-yaml Advisory).

Upgrade js-yaml to version 4.2.0 (for the 4.x branch) or 3.15.0 (for the 3.x branch), which deduplicate merge sources by reference before invoking mergeMappings(), eliminating the quadratic behavior. If immediate patching is not possible, implement input validation and size limits on YAML documents accepted by the application, and consider rate-limiting YAML parsing requests to reduce the impact of repeated submissions. Restricting untrusted YAML input at the application boundary is an effective interim control (GitHub Advisory, js-yaml Advisory).

The vulnerability was reported by researcher 0xbughunter and analyzed by multiple contributors including soren121, mazze93, G-Rath, dargmuesli, and omgovich through the GitHub Security Advisory process. The maintainer puzrin published the advisory and coordinated the fix. The issue has been picked up by standard vulnerability tracking platforms (Vulners, OSV, VulnDB, CVEFeed) and scanner vendors (Tenable Nessus, Qualys), and an openSUSE security announcement was issued. No significant social media controversy or major media coverage has been identified beyond routine vulnerability disclosure channels (js-yaml Advisory, GitHub Advisory).