CVE-2026-73643

A flaw was found in js-yaml, a JavaScript YAML parser. A remote attacker could exploit this vulnerability by providing specially crafted YAML input containing nested flow collections. This can lead to exponential parsing time when the application processes untrusted input, consuming excessive CPU resources. This resource exhaustion can block the Node.js event loop and cause a Denial of Service (DoS) for the affected process.

This is an Important denial-of-service flaw in the js-yaml library, where processing specially crafted YAML input can lead to exponential parsing time. This can cause applications utilizing affected versions of js-yaml within Red Hat products to consume excessive CPU resources, potentially blocking the Node.js event loop and leading to service unavailability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict applications from processing untrusted YAML input with affected versions of the js-yaml library. Implement strict input validation to ensure that only trusted and well-formed YAML data is processed. If the application is exposed to external, untrusted sources, consider isolating the application or implementing additional resource limits to prevent complete service disruption.