--- id: CVE-2026-73643 title: js-yaml is a JavaScript YAML parser and dumper summary: >- js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-407 - CWE-1333 published: '2026-08-13' updated: '2026-09-18' sourceUpdated: '2026-09-18T20:09:01.757' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73643' references: - url: >- https://github.com/nodeca/js-yaml/commit/3e5240f9cbe645ce5afb58524954a13c8539c853 label: security-advisories@github.com - url: 'https://github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5' label: security-advisories@github.com - url: 'https://github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5' label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73643.json - url: 'https://access.redhat.com/security/cve/CVE-2026-73643' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2515531' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-73643' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73643' - url: 'https://access.redhat.com/errata/RHSA-2026:61314' - url: 'https://access.redhat.com/errata/RHSA-2026:66003' - url: 'https://access.redhat.com/errata/RHSA-2026:61783' - url: 'https://access.redhat.com/errata/RHSA-2026:65126' - url: 'https://access.redhat.com/errata/RHSA-2026:63050' - url: 'https://access.redhat.com/errata/RHSA-2026:60447' - url: 'https://access.redhat.com/errata/RHSA-2026:60478' - url: 'https://access.redhat.com/errata/RHSA-2026:60442' - url: 'https://access.redhat.com/errata/RHSA-2026:68044' - url: 'https://access.redhat.com/errata/RHSA-2026:68253' - url: 'https://access.redhat.com/errata/RHSA-2026:68006' - url: 'https://access.redhat.com/errata/RHSA-2026:68254' - url: 'https://access.redhat.com/errata/RHSA-2026:68681' tags: - nvd - csaf - vex - red-hat epss: 0.00344 epssPercentile: 0.28007 ingestedAt: '2026-09-18T20:51:25.608Z' vendor: Red Hat product: Red Hat OpenShift AI 2.25 affected: - migration_toolkit_for_containers - node_healthcheck_operator - openshift_lightspeed - openshift_pipelines - advanced_cluster_security 4 - ceph_storage 4 - ceph_storage 9 - edge_manager 1 - enterprise_linux_ai_rhel_ai 3 - openshift_ai_rhoai - openshift_container_platform 4 - openshift_data_foundation 4 - openshift_gitops - trusted_artifact_signer - trusted_profile_analyzer - secrets_management_console_for_red_hat_openshift - cluster_observability_operator 1.5.0 - ansible_automation_platform 2.2 - discovery 2 - openshift_ai 2.25 - openshift_container_platform 4.19 - openshift_container_platform 4.20 - openshift_container_platform 4.21 - openshift_container_platform 4.22 patched: - cluster_observability_operator 1.5.0 - ansible_automation_platform 2.2 - discovery 2 - openshift_ai 2.25 - openshift_container_platform 4.19 - openshift_container_platform 4.20 - openshift_container_platform 4.21 - openshift_container_platform 4.22 --- ## Overview js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:61314** · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61314) - **RHSA-2026:66003** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66003) - **RHSA-2026:61783** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61783) - **RHSA-2026:65126** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65126) - **RHSA-2026:63050** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:63050) - **RHSA-2026:60447** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:60447) - **RHSA-2026:60478** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.21 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:60478) - **RHSA-2026:60442** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:60442) - **Red Hat VEX** · Important · affected: Node HealthCheck Operator, OpenShift Lightspeed, OpenShift Pipelines, Red Hat Advanced Cluster Security 4, Red Hat Ceph Storage 4, Red Hat Ceph Storage 9, … · no fix planned: Red Hat Advanced Cluster Security 4, Red Hat OpenShift GitOps, Red Hat Trusted Artifact Signer, Red Hat Trusted Profile Analyzer, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73643.json) - **RHSA-2026:68044** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68044) - **RHSA-2026:68253** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68253) - **RHSA-2026:68006** · Red Hat · fixed in: Red Hat Edge Manager 1.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68006) - **RHSA-2026:68254** · Red Hat · fixed in: Red Hat Edge Manager 1.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68254) - **RHSA-2026:68681** · Red Hat · fixed in: Red Hat Migration Toolkit 1.8 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68681)