CyberRota Analysis
AI-GeneratedThe js-yaml library versions 5.0.0 to 5.2.2 are vulnerable to a denial-of-service attack due to inefficient parsing of untrusted YAML input, which can lead to exponential processing time and significant CPU resource consumption. This vulnerability can cause applications to become unresponsive, particularly in environments where YAML documents are processed frequently. Organizations using affected versions of js-yaml should prioritize upgrading to version 5.2.2 or later to mitigate the risk of service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2.