{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/nodeca/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["js-yaml"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","yaml","javascript","vulnerability"],"_cs_type":"advisory","_cs_vendors":["nodeca"],"content_html":"\u003cp\u003eA critical denial of service vulnerability exists within the \u003ccode\u003ejs-yaml\u003c/code\u003e JavaScript library, affecting versions 5.0.0 through 5.2.1. This flaw, reported by GHSA, stems from an exponential parsing time issue when handling specific deeply nested flow collections within YAML documents. Attackers can craft a small, under 200-byte YAML payload that, when processed by a vulnerable application using \u003ccode\u003ejs-yaml\u003c/code\u003e's \u003ccode\u003eload()\u003c/code\u003e or \u003ccode\u003eloadAll()\u003c/code\u003e functions, causes the parser to re-evaluate sections multiple times. This results in a computational complexity of O(2^n), where 'n' is the nesting depth. The excessive CPU consumption effectively blocks the Node.js event loop, rendering the application unresponsive and leading to a complete denial of service. The vulnerability requires no special YAML features like anchors or non-default options, making it broadly exploitable against applications processing untrusted YAML input.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious YAML payload specifically designed to trigger exponential parsing.\u003c/li\u003e\n\u003cli\u003eThe crafted payload contains deeply nested flow sequences, specifically patterns such as \u003ccode\u003e[ [ ... ] : 0 ]\u003c/code\u003e within a \u003ccode\u003ekey: value\u003c/code\u003e structure.\u003c/li\u003e\n\u003cli\u003eThe attacker sends this small (e.g., under 200 bytes) YAML document to a target application that uses the \u003ccode\u003ejs-yaml\u003c/code\u003e library (versions 5.0.0-5.2.1) for parsing.\u003c/li\u003e\n\u003cli\u003eThe application invokes \u003ccode\u003ejs-yaml.load()\u003c/code\u003e or \u003ccode\u003ejs-yaml.loadAll()\u003c/code\u003e to parse the untrusted YAML input.\u003c/li\u003e\n\u003cli\u003eDuring the parsing process, \u003ccode\u003ejs-yaml\u003c/code\u003e encounters the nested flow collections and, due to an underlying parsing inefficiency, repeatedly rewinds and re-parses entries multiple times.\u003c/li\u003e\n\u003cli\u003eThis re-parsing leads to an exponential increase in processing time (O(2^n)) and consumes significant CPU resources, even for relatively shallow nesting (e.g., 30 levels taking over 2 minutes).\u003c/li\u003e\n\u003cli\u003eThe Node.js event loop of the target application becomes blocked by the intensive parsing operation, preventing it from handling any further requests.\u003c/li\u003e\n\u003cli\u003eThe application becomes unresponsive and unavailable to legitimate users, resulting in a complete denial of service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability leads to a denial of service, where a single, small, specially crafted YAML request can monopolize a server's CPU for minutes or even longer. For example, a payload with 22 nesting levels can take approximately 1 second to parse, while 26 levels can take 17 seconds, and 30 levels can exceed 2 minutes, all from an input under 200 bytes. This resource exhaustion blocks the Node.js event loop, causing the entire application to become unresponsive and unavailable to other users or services. Any application processing untrusted YAML input via \u003ccode\u003ejs-yaml\u003c/code\u003e versions 5.0.0 through 5.2.1 is susceptible, potentially affecting web servers, APIs, or configuration management systems across various sectors that rely on YAML for data interchange.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch \u003ccode\u003ejs-yaml\u003c/code\u003e to a version greater than 5.2.1 immediately to mitigate the exponential parsing vulnerability.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and sanitization for all untrusted YAML input processed by applications using the \u003ccode\u003ejs-yaml\u003c/code\u003e library.\u003c/li\u003e\n\u003cli\u003eDeploy the provided YAML payload as a test case in development environments to identify any remaining vulnerable \u003ccode\u003ejs-yaml\u003c/code\u003e instances.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T16:50:37Z","date_published":"2026-07-24T16:50:37Z","id":"https://feed.craftedsignal.io/briefs/2026-07-js-yaml-dos/","summary":"A denial of service vulnerability exists in the js-yaml library (versions 5.0.0 through 5.2.1) due to an exponential parsing time bug in flow collections, allowing attackers to craft a small YAML document which, when processed by `load()` or `loadAll()` functions, consumes significant CPU resources and blocks the Node.js event loop.","title":"js-yaml Denial of Service via Exponential Parsing Time in Flow Collections","url":"https://feed.craftedsignal.io/briefs/2026-07-js-yaml-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Nodeca","version":"https://jsonfeed.org/version/1.1"}