js-yaml: js-yaml: Denial of Service via crafted YAML merge keys

🗓️ 11 Jul 2026 04:58:36Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 5 Views

A crafted YAML document reuses merge aliases to cause CPU exhaustion and Denial of Service in js-yaml.

Reporter	Title	Published	Views	Family All 64
attackerkb	CVE-2026-53550	22 Jun 202614:59	–	attackerkb
ibm	Security Bulletin: Multiple vulnerabilities in IBM Software Support App	9 Jul 202621:50	–	ibm
cgr	CVE-2026-53550 vulnerabilities	16 Jun 202620:22	–	cgr
circl	CVE-2026-53550	31 May 202623:39	–	circl
cve	CVE-2026-53550	22 Jun 202614:59	–	cve
cvelist	CVE-2026-53550 js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases	22 Jun 202614:59	–	cvelist
debiancve	CVE-2026-53550	22 Jun 202614:59	–	debiancve
euvd	EUVD-2026-38256	22 Jun 202614:59	–	euvd
github	JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases	15 Jun 202617:15	–	github
nvd	CVE-2026-53550	22 Jun 202616:16	–	nvd

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	any	aarch64	nodejs24	24.18.0-0.3.hum1	nodejs24-24.18.0-0.3.hum1.aarch64.rpm
Red Hat Hardened Images	any	x86_64	nodejs24	24.18.0-0.3.hum1	nodejs24-24.18.0-0.3.hum1.x86_64.rpm
Red Hat Hardened Images	any	noarch	nodejs24-bin	24.18.0-0.3.hum1	nodejs24-bin-24.18.0-0.3.hum1.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-53550
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-53550
cve	www.cve.org/CVERecord

16 Jul 2026 15:36Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.15.3

EPSS0.00259

SSVC

yaml merge aliases cpu exhaustion denial of service yaml parser security flaw