CVE-2026-33532 - Vulnerability Analysis

Overview

yaml JavaScript parser 1.x < 1.10.3 and 2.x < 2.8.3 contains a denial of service caused by unbounded recursive calls in node resolution/composition phase, letting attackers trigger stack overflow and crash Node.js process, exploit requires attacker to supply crafted YAML input.

Severity & Score

Impact

Attackers can cause application crashes or denial of service by triggering stack overflow with crafted YAML input.

Mitigation

Update to version 1.10.3, 2.8.3 or later.

References

• https://github.com/eemeli/yaml/commit/1e84ebbea7ec35011a4c61bbb820a529ee4f359b
• https://github.com/eemeli/yaml/releases/tag/v1.10.3
• https://github.com/eemeli/yaml/releases/tag/v2.8.3
• https://github.com/eemeli/yaml/security/advisories/GHSA-48c2-rrv3-qjmp

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner