High [CVE-2026-73643] Denial of Service via exponential parsing in flow collections

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input.

In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair.

If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required.

This issue is fixed in version 5.2.2. A remote attacker could exploit this vulnerability by providing specially crafted YAML input containing nested flow collections.

This can lead to exponential parsing time when the application processes untrusted input, consuming excessive CPU resources. This resource exhaustion can block the Node.js event loop and cause a Denial of Service (DoS) for the affected process.

This is an Important denial-of-service flaw in the `js-yaml` library, where processing specially crafted YAML input can lead to exponential parsing time.