CVE-2026-53550

Summary

A crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence.
This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service.

Details

The issue is in merge handling inside lib/loader.js:

• storeMappingPair(...) iterates every element of a merge sequence when key tag is tag:yaml.org,2002:merge.
• For each element, it calls mergeMappings(...).
• mergeMappings(...) computes Object.keys(source) and performs _hasOwnProperty.call(destination, key) checks for each key.

When input is of the form:

a: &a {k0:0, k1:0, ..., kK:0} b: {<<: [*a, *a, *a, ... repeated M times ...]} all *a entries refer to the same anchored object. After the first merge, subsequent merges are semantically no-ops, but the parser still reprocesses all keys each time. Resulting work is O(K * M), while input size is O(K + M), giving quadratic scaling as payload grows. Relevant code path: lib/loader.js in storeMappingPair(...) merge branch (keyTag === 'tag:yaml.org,2002:merge') lib/loader.js mergeMappings(...)

Root cause

File: lib/loader.js Function: storeMappingPair(state, _result, overridableKeys, keyTag, keyNode, valueNode, startLine, startLineStart, startPos) Lines: ~359-366

if (keyTag === 'tag:yaml.org,2002:merge') {
  if (Array.isArray(valueNode)) {
    for (index = 0, quantity = valueNode.length; index < quantity; index += 1) {
      mergeMappings(state, _result, valueNode[index], overridableKeys);
    }
  } else {
    mergeMappings(state, _result, valueNode, overridableKeys);
  }
}

When the merge value is a sequence (YAML 1.1 <<: [ *a, *a, ... ]), each element is handed to mergeMappings() without deduplication. mergeMappings() then does

sourceKeys = Object.keys(source);
for (index = 0; index < sourceKeys.length; index += 1) {
  key = sourceKeys[index];
  if (!_hasOwnProperty.call(destination, key)) {
    setProperty(destination, key, source[key]);
    overridableKeys[key] = true;
  }
}

Every alias reference in the sequence resolves (by design) to the SAME object via state.anchorMap. After the first merge, every subsequent merge of that same reference is a pure no-op semantically, but still performs:

• one Object.keys(source) call (O(K))
• K _hasOwnProperty.call checks on the destination

Total: M * K hasOwnProperty checks + M Object.keys allocations, while the final object and all observable side effects are identical to a single merge.

YAML semantics for <<: are idempotent and commutative over duplicate sources, so collapsing duplicates preserves behavior exactly; this isn't a spec trade-off.

PoC

Environment: js-yaml version: 4.1.1 Node.js: v24.5.0 Platform: arm64 macOS (reproduced consistently) Reproduction script: Create many keys in one anchored map (&a). Merge that same alias repeatedly via <<: [*a, *a, ...]. Measure parse time and compare with control payload using single merge (<<: *a). Observed repeated runs (same machine): K=M=1000, input 9,909 bytes: ~33–36 ms K=M=2000, input 20,909 bytes: ~121–123 ms K=M=4000, input 42,909 bytes: ~524–537 ms K=M=6000, input 64,909 bytes: ~1,608–1,829 ms K=M=8000, input 86,909 bytes: ~3,395–3,565 ms Control (single merge, similar key counts): K=2000: ~1–2 ms K=4000: ~3 ms K=8000: ~5 ms Also verified: repeated-merge output equals single-merge output (same key count and same JSON), confirming excess time is redundant computation.

Impact

This is a denial-of-service vulnerability (CPU exhaustion / algorithmic complexity). Any service parsing untrusted YAML with js-yaml can be impacted, including API backends, CI tools, config processors, and automation services. An attacker can submit crafted YAML to…

js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.

TuxCare rebuilt js-yaml to address 2 CVEs. Fixed in 4.1.0-tuxcare.1.

TuxCare rebuilt js-yaml to address 3 CVEs. Fixed in 3.14.1-tuxcare.1.

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.14.2-tuxcare.2.

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.15.2-tuxcare.1.

TuxCare rebuilt js-yaml to address 5 CVEs. Fixed in 3.13.1-tuxcare.1.

These are all security issues fixed in the python311-pydata-sphinx-theme-0.19.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-pytest-html-4.2.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the agama-integration-tests-1785848065.5562c7c-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the agama-web-ui-24+0.a836cced5-52.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the velociraptor-0.76.7.0.git145.b60ef1146-1.1 package on the GA media of openSUSE Tumbleweed.

This update for python-pytest-html fixes the following issues:

Changes in python-pytest-html:

• Revendor updating shell-quote and js-yaml deps:
  • CVE-2026-13311: shell-quote: inefficient input parsing can lead to a denial of service (bsc#1269361)
  • CVE-2026-53550: js-yaml: quadratic complexity when processing a crafted YAML document can lead to CPU exhaustion (bsc#1268818)

This update for agama-web-ui fixes the following issues:

• CVE-2025-7783: form-data: unsafe Math.random() function is used to select a boundary value for multipart form-encoded data (bsc#1246822).
• CVE-2026-12143: form-data: CRLF injection via unescaped multipart field names and filenames (bsc#1272310).
• CVE-2026-13149: brace-expansion: expand() function exhibits exponential-time complexity when processing non-expanding {} brace groups (bsc#1269927).
• CVE-2026-13311: shell-quote: quadratic complexity in parse() function when processing specially crafted strings (bsc#1269359).
• CVE-2026-13676: fast-uri: host-based policy bypass due to failure to canonicalize Unicode/IDN hostnames for HTTP-family URLs (bsc#1269595).
• CVE-2026-27601: underscore: DoS via stack overflow due to missing depth limits in _.flatten and _.isEqual functions (bsc#1259169).
• CVE-2026-40181: react-router: open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs (bsc#1272311).
• CVE-2026-49356: @babel/core: arbitrary file read via sourceMappingURL comment (bsc#1272317).
• CVE-2026-53550: js-yaml: quadratic complexity in merge-key processing when processing a crafted YAML document (bsc#1268851).
• CVE-2026-53632: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows (bsc#1272319).
• CVE-2026-54466: websocket-driver: message corruption via abuse of protocol length headers (bsc#1272312).
• CVE-2026-54490: websocket-driver: resource limit bypass via message compression (bsc#1272313).
• CVE-2026-55602: http-proxy-middleware: Host-header-driven backend routing bypass via router host+path substring matching (bsc#1272318).

Root has patched CVE-2026-53550 in the js-yaml package for Root:npm. Multiple fixed versions available.