CVE-2026-33532
is a YAML parser and serialiser for JavaScript.
Published Mar 26, 2026 · updated Jun 17, 2026 · eemeli yaml
is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a with a small payload (~2–10 KB). The is not a , so applications that only catch YAML-specific errors will encounter an unexpected exception type. Depending on the host application's exception handling, this can fail requests or terminate the Node.js process. Flow sequences allow deep nesting with minimal bytes (2 bytes per level: one and one ). On the default Node.js stack, approximately 1,000–5,000 levels of nesting (2–10 KB input) exhaust the call stack. The exact threshold is environment-dependent (Node.js version, stack size, call stack depth at invocation). Note: the library's (CST phase) uses a stack-based iterative approach and is not affected. Only the compose/resolve phase uses actual call-stack recursion. All three public parsing APIs are affected: , , and . Versions 1.10.3 and 2.8.3 contain a patch.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 26, 2026 · NIST NVD
Detected
is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a with a small payload (~2–10 KB). The is not
Jun 17, 2026 · NIST NVD
Updated
is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a with a small payload (~2–10 KB). The is not
Affected
- cpe eemeli/yamlversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33532
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33532
is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive funct
nvd.nist.gov