{"id":"CVE-2026-73643","title":"js-yaml is a JavaScript YAML parser and dumper","summary":"js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-407","CWE-1333"],"published":"2026-08-13","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73643","references":[{"url":"https://github.com/nodeca/js-yaml/commit/3e5240f9cbe645ce5afb58524954a13c8539c853","label":"security-advisories@github.com"},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5","label":"security-advisories@github.com"},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73643.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-73643"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515531"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73643"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73643"},{"url":"https://access.redhat.com/errata/RHSA-2026:61314"},{"url":"https://access.redhat.com/errata/RHSA-2026:66003"},{"url":"https://access.redhat.com/errata/RHSA-2026:61783"},{"url":"https://access.redhat.com/errata/RHSA-2026:65126"},{"url":"https://access.redhat.com/errata/RHSA-2026:63050"},{"url":"https://access.redhat.com/errata/RHSA-2026:60447"},{"url":"https://access.redhat.com/errata/RHSA-2026:60478"},{"url":"https://access.redhat.com/errata/RHSA-2026:60442"},{"url":"https://access.redhat.com/errata/RHSA-2026:68044"},{"url":"https://access.redhat.com/errata/RHSA-2026:68253"},{"url":"https://access.redhat.com/errata/RHSA-2026:68006"},{"url":"https://access.redhat.com/errata/RHSA-2026:68254"},{"url":"https://access.redhat.com/errata/RHSA-2026:68681"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00344,"epssPercentile":0.28007,"ingestedAt":"2026-09-18T20:51:25.608Z","vendor":"Red Hat","product":"Red Hat OpenShift AI 2.25","affected":["migration_toolkit_for_containers","node_healthcheck_operator","openshift_lightspeed","openshift_pipelines","advanced_cluster_security 4","ceph_storage 4","ceph_storage 9","edge_manager 1","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","openshift_container_platform 4","openshift_data_foundation 4","openshift_gitops","trusted_artifact_signer","trusted_profile_analyzer","secrets_management_console_for_red_hat_openshift","cluster_observability_operator 1.5.0","ansible_automation_platform 2.2","discovery 2","openshift_ai 2.25","openshift_container_platform 4.19","openshift_container_platform 4.20","openshift_container_platform 4.21","openshift_container_platform 4.22"],"patched":["cluster_observability_operator 1.5.0","ansible_automation_platform 2.2","discovery 2","openshift_ai 2.25","openshift_container_platform 4.19","openshift_container_platform 4.20","openshift_container_platform 4.21","openshift_container_platform 4.22"],"slug":"CVE-2026-73643","body":"## Overview\n\njs-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:61314** · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61314)\n- **RHSA-2026:66003** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66003)\n- **RHSA-2026:61783** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61783)\n- **RHSA-2026:65126** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65126)\n- **RHSA-2026:63050** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:63050)\n- **RHSA-2026:60447** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:60447)\n- **RHSA-2026:60478** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.21 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:60478)\n- **RHSA-2026:60442** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:60442)\n- **Red Hat VEX** · Important · affected: Node HealthCheck Operator, OpenShift Lightspeed, OpenShift Pipelines, Red Hat Advanced Cluster Security 4, Red Hat Ceph Storage 4, Red Hat Ceph Storage 9, … · no fix planned: Red Hat Advanced Cluster Security 4, Red Hat OpenShift GitOps, Red Hat Trusted Artifact Signer, Red Hat Trusted Profile Analyzer, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73643.json)\n- **RHSA-2026:68044** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68044)\n- **RHSA-2026:68253** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68253)\n- **RHSA-2026:68006** · Red Hat · fixed in: Red Hat Edge Manager 1.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68006)\n- **RHSA-2026:68254** · Red Hat · fixed in: Red Hat Edge Manager 1.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68254)\n- **RHSA-2026:68681** · Red Hat · fixed in: Red Hat Migration Toolkit 1.8 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68681)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}