GHSA-pm4m-ph32-ghv5: js-yaml: Exponential parsing time in flow collections leads to denial of service

July 24, 2026 (updated August 13, 2026)

Parsing a small YAML document can take exponential time. An application that calls load() or loadAll() on untrusted input can be hung by a payload under 200 bytes.

References

github.com/advisories/GHSA-pm4m-ph32-ghv5
github.com/nodeca/js-yaml/commit/3e5240f9cbe645ce5afb58524954a13c8539c853
github.com/nodeca/js-yaml/releases/tag/5.2.2
github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5
nvd.nist.gov/vuln/detail/CVE-2026-73643

Code Behaviors & Features

Detect and mitigate GHSA-pm4m-ph32-ghv5 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →