CVE-2026-73643

About vulnerability

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2.

Affected product:

AngularJS , Babel , Bouncy Castle , EndemolShineGroup/cosmiconfig-typescript-loader , Next.js , Node.js , React , Vue , adk-js , allure-js , apidevtools-json-schema-ref-parser , apollo , apollo-server , appium , apply-release-plan , assetgraph , astro , astrojs-cloudflare , astrojs-node , astrojs-react , astrojs-tailwind , async-storage , ava , aws-lambda , babel-eslint , babel-plugin-istanbul , berry , build , celo-celocli , changesets , changesets-release-utils , cli-ux , codeceptjs , commit-analyzer , commitlint , commitlint-prompt , config , config-inspector , configstore , configure , confluent-kafka-javascript , cosmiconfig , cosmiconfig-typescript-loader , css-loader , cssnano , datadog-ci , devtools , documentation , docusaurus , docusaurus-babel , docusaurus-bundler , docusaurus-core , docusaurus-mdx-loader , docusaurus-plugin-content-blog , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-css-cascade-layers , docusaurus-plugin-debug , docusaurus-plugin-google-analytics , docusaurus-plugin-google-gtag , docusaurus-plugin-google-tag-manager , docusaurus-plugin-sitemap , docusaurus-plugin-svgr , docusaurus-theme-classic , docusaurus-theme-common , docusaurus-theme-search-algolia , docusaurus-utils , docusaurus-utils-validation , ecosystem , editor , electron-mocha , elements , ember-cli , eslint , eslint-community/eslint-utils , eslint-compat-utils , eslint-config-airbnb-base , eslint-config-ipfs , eslint-config-love , eslint-config-prettier , eslint-config-react-app , eslint-config-standard , eslint-etc , eslint-import-resolver-typescript , eslint-loader , eslint-plugin-compat , eslint-plugin-es , eslint-plugin-es-x , eslint-plugin-eslint-comments , eslint-plugin-etc , eslint-plugin-flowtype , eslint-plugin-ft-flow , eslint-plugin-import , eslint-plugin-jest , eslint-plugin-jest-dom , eslint-plugin-jsdoc , eslint-plugin-jsx-a11y , eslint-plugin-n , eslint-plugin-node , eslint-plugin-prettier , eslint-plugin-promise , eslint-plugin-react , eslint-plugin-react-native , eslint-plugin-standard , eslint-plugin-testing-library , eslint-rewrite , eslint-utils , eslintrc , expo , expo-application , expo-camera , expo-cli , expo-device , expo-file-system , expo-glass-effect , expo-localization , expo-manifests , expo-module-scripts , expo-plugin-help , expo-updates , expo-updates-interface , expo-vector-icons , fork-ts-checker-webpack-plugin , gateway , gatsby , get-workspaces , github , gp-js-client , graphql-code-generator , graphql-config , graphql-hive-envelop , graphql-hive-gateway , graphql-hive-gateway-runtime , graphql-hive-gateway-testing , graphql-hive-logger-pino , graphql-hive-plugin-aws-sigv4 , graphql-hive-plugin-opentelemetry , graphql-hive-router-runtime , graphql-language-service-server , graphql-mesh , graphql-mesh-cli , graphql-mesh-compose-cli , graphql-mesh-config , graphql-mesh-fusion-runtime , graphql-mesh-grpc , graphql-mesh-incontext-sdk-codegen , graphql-mesh-migrate-config-cli , graphql-mesh-plugin-opentelemetry , graphql-mesh-plugin-operation-headers , graphql-mesh-plugin-prometheus , graphql-mesh-transport-grpc , graphql-mesh-transport-http , graphql-mesh-transport-http-callback , graphql-tools , gray-matter , grunt , grunt-karma , hardhat , hermes , hey-api , hey-api-client-fetch , htmlnano , istanbul , istanbuljs , istanbuljs-nyc-config-babel , jest , jest-chain-transform , jest-preset-angular , jest-repl , jest-specific-snapshot , jest-watch-typeahead , js-yaml , json-schema-ref-parser , karma-coverage-istanbul-reporter , kubernetes-client-node , lerna , lingui-babel-plugin-lingui-macro , lingui-conf , lingui-format-po , load-nyc-config , load-yaml-file , loopback , loopback-connector , loopback-connector-remote , loopback-datasource-juggler , loopback-phase , lottie-react-native , magic-js , manypkg , markdownlint-cli , mastra , mastra-mcp , mastra-observability , material-ui , metalsmith , metamask-snaps-cli , metamask-snaps-jest , metro , microsoft-365-agents-toolkit , microsoft-api-documenter , middleware , mocha , modern.js , module-federation-core , module-federation/core , monorepo , netlify-build , netlify-cms , netlify-cms-app , netlify-cms-core , netlify-dev , newrelic-security-agent , nomicfoundation-hardhat-ethers , npm , nuxt , nyc , oas-normalize , oclif-plugin-autocomplete , oclif-plugin-not-found , oclif-plugin-plugins , oclif-plugin-warn-if-update-available , oclif/core , omnigraph-neo4j , onflow-fcl-react-native , open-wc-testing-karma , open-wc-testing-karma-bs , openapi-typescript-codegen , optimize-css-assets-webpack-plugin , orval , oxc , packages , parcel-bundler , parse , percy-cli , percy-cli-app , percy-cli-build , percy-cli-command , percy-cli-config , percy-cli-doctor , percy-cli-exec , percy-cli-snapshot , percy-cli-upload , percy-client , percy-core , percy-monitoring , percy-webdriver-utils , pigment-css , plugin-commands , plugin-help , pnpm , postcss-load-config , postcss-load-options , postcss-load-plugins , postcss-loader , postcss-svgo , pre , preferred-pm , prettyhtml , puppeteer , read-yaml-file , readme-postman-to-openapi , redocly-cli , relay , release-notes-generator , remark-cli , remark-mdx-frontmatter , remix , rsbuild , rspress , rushstack , rushstack-eslint-config , rushstack-heft-node-rig , rushstack-heft-web-rig , rushstack-lockfile-explorer , rushstack-package-extractor , sanity , sanity-cli , sdk-typescript , semantic-release , semantic-release-changelog , semantic-release-git , sentry-browser , services , shifter , strapi , strong-globalize , strong-remoting , stylelint , stylelint-no-unsupported-browser-features , stylelint-scss , subfont , supertap , sveltedoc-parser , svgo , svgr , swagger , swagger-js , swagger-parser , tanstack-react-start , tanstack-react-start-rsc , tanstack-solid-start , tanstack-start-plugin-core , tapjs , testem , tldts , ts-jest , tslint , tslint-consistent-codestyle , typescript-eslint , unified-args , unified-engine , vechain-sdk-js , vercel , vercel-frameworks , vercel-fs-detectors , vercel-python-analysis , verdaccio , vite-plugin-istanbul , wdio-mocha-framework , web , web-infra-dev/modern.js , webdriverio , webpack-cli-generators , which-pm , wotan , wyw-in-js , xmlbuilder2 , yarnpkg-plugin-compat , yarnpkg-plugin-npm-cli , yarnpkg-plugin-pnp , yarnpkg-sdks , yarnpkg-shell , yeoman-generator , yeoman/environment , zephyr-packages

Affected packages:

expo-router @ 58.0.4 (+3919 more)