high · 7.5Jul 24, 2026

js-yaml: Exponential Parsing DoS via Nested Flow Collections

Shubham Kandhare
Security Engagement Manager, SecureLayer7

Sending a tiny YAML snippet with deeply nested flow sequences to any app that calls js-yaml's load() can freeze the Node.js process for minutes, blocking all other requests.

Packagejs-yaml
Ecosystemnpm
Affected>= 5.0.0, <= 5.2.1
Fixed in5.2.2
js-yaml: Exponential Parsing DoS via Nested Flow Collections

The problem

js-yaml 5.0.0 through 5.2.1 parses flow collections in a way that causes O(2^n) work as nesting depth grows.

When a flow-sequence entry turns out to be a key-value pair, the parser rewinds and re-parses that entry as the key via restoreState plus a second parseNode call in readFlowCollection. Each nested level doubles the work. At 30 levels the input is under 200 bytes but parsing takes over two minutes, blocking the Node.js event loop entirely for the duration.

Proof of concept

A working proof-of-concept for this issue in js-yaml, with the exact payload below.

javascript
const yaml = require('js-yaml');
const n = 30;
// ~180 bytes, hangs the process for 2+ minutes
yaml.load('[ '.repeat(n) + '1' + ' ]: 0'.repeat(n));

The root cause is in readFlowCollection (parser.ts): when the parser discovers that a sequence entry is actually a mapping key, it calls restoreState to rewind and then calls parseNode a second time to re-parse the same subtree. Because every nested flow sequence triggers this rewind, the total parse attempts double at each depth level, giving O(2^n) complexity (CWE-407: Inefficient Algorithmic Complexity).

The fix in commit 3e5240f9 eliminates the redundant re-parse path, so each node is visited at most once regardless of nesting depth.

The fix

Upgrade js-yaml to 5.2.2 or later. The patch commit 3e5240f9cbe645ce5afb58524954a13c8539c853 removes the double-parse in readFlowCollection. If an immediate upgrade is not possible, validate or size-limit untrusted YAML input before passing it to load() or loadAll().

Reporter not attributed.

References: [1][2][3][4]

Related research