GHSA-pm4m-ph32-ghv5: js-yaml: Exponential parsing time in flow collections leads to denial of service

July 24, 2026

Parsing a small YAML document can take exponential time. An application that calls load() or loadAll() on untrusted input can be hung by a payload under 200 bytes.

References

github.com/advisories/GHSA-pm4m-ph32-ghv5
github.com/nodeca/js-yaml/commit/3e5240f9cbe645ce5afb58524954a13c8539c853
github.com/nodeca/js-yaml/releases/tag/5.2.2
github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5

Code Behaviors & Features

Detect and mitigate GHSA-pm4m-ph32-ghv5 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →