yaml is vulnerable to Stack Overflow via deeply nested YAML collections

🗓️ 25 Mar 2026 20:08:24Reported by GitHub Advisory DatabaseType

YAML parsing can cause a RangeError from deeply nested flow sequences, affecting all parsing APIs.

Reporter	Title	Published	Views	Family All 46
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Jun 202607:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to arbitrary code execution, loss of confidentiality and denial of service	6 May 202613:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security SOAR is using a component with a known vulnerability (CVE-2026-33532)	23 Apr 202614:15	–	ibm
IBM Security Bulletins	Security Bulletin: DevOps Test Performance contains a vulnerability related to use of yaml JavaScript library	17 Apr 202618:45	–	ibm
ATTACKERKB	CVE-2026-33532	26 Mar 202619:49	–	attackerkb
Chainguard	CVE-2026-33532 vulnerabilities	28 Mar 202601:17	–	cgr
Circl	CVE-2026-33532	23 Mar 202618:31	–	circl
CNNVD	YAML 安全漏洞	26 Mar 202600:00	–	cnnvd
CVE	CVE-2026-33532	26 Mar 202619:49	–	cve
Cvelist	CVE-2026-33532 yaml is vulnerable to Stack Overflow via deeply nested YAML collections	26 Mar 202619:49	–	cvelist

Vulners

Node

yaml_project yamlRange1.0.0–1.10.3npm

yaml_project yamlRange2.0.0–2.8.3npm

Source	Link
github	www.github.com/eemeli/yaml/security/advisories/GHSA-48c2-rrv3-qjmp
github	www.github.com/eemeli/yaml/commit/1e84ebbea7ec35011a4c61bbb820a529ee4f359b
github	www.github.com/eemeli/yaml/releases/tag/v1.10.3
github	www.github.com/eemeli/yaml/releases/tag/v2.8.3
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-33532
github	www.github.com/advisories/GHSA-48c2-rrv3-qjmp

27 Mar 2026 21:34Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.14.3

EPSS0.00025

SSVC