CVE-2026-53550: JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

June 15, 2026 (updated June 29, 2026)

A crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service.

References

github.com/advisories/GHSA-h67p-54hq-rp68
github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68
nvd.nist.gov/vuln/detail/CVE-2026-53550

Code Behaviors & Features

Detect and mitigate CVE-2026-53550 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →