CVE-2026-33532

{"id": "CVE-2026-33532", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2026-03-26T20:16:15.543", "references": [{"url": "https://github.com/eemeli/yaml/commit/1e84ebbea7ec35011a4c61bbb820a529ee4f359b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/eemeli/yaml/releases/tag/v1.10.3", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/eemeli/yaml/releases/tag/v2.8.3", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/eemeli/yaml/security/advisories/GHSA-48c2-rrv3-qjmp", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-674"}]}], "descriptions": [{"lang": "en", "value": "`yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a `RangeError: Maximum call stack size exceeded` with a small payload (~2\u201310 KB). The `RangeError` is not a `YAMLParseError`, so applications that only catch YAML-specific errors will encounter an unexpected exception type. Depending on the host application's exception handling, this can fail requests or terminate the Node.js process. Flow sequences allow deep nesting with minimal bytes (2 bytes per level: one `[` and one `]`). On the default Node.js stack, approximately 1,000\u20135,000 levels of nesting (2\u201310 KB input) exhaust the call stack. The exact threshold is environment-dependent (Node.js version, stack size, call stack depth at invocation). Note: the library's `Parser` (CST phase) uses a stack-based iterative approach and is not affected. Only the compose/resolve phase uses actual call-stack recursion. All three public parsing APIs are affected: `YAML.parse()`, `YAML.parseDocument()`, and `YAML.parseAllDocuments()`. Versions 1.10.3 and 2.8.3 contain a patch."}, {"lang": "es", "value": "`yaml` es un analizador y serializador YAML para JavaScript. Analizar un documento YAML con una versi\u00f3n de `yaml` en la rama 1.x anterior a la 1.10.3 o en la rama 2.x anterior a la 2.8.3 puede lanzar un RangeError debido a un desbordamiento de pila. La fase de resoluci\u00f3n/composici\u00f3n de nodos utiliza llamadas a funciones recursivas sin un l\u00edmite de profundidad. Un atacante que puede proporcionar YAML para el an\u00e1lisis puede desencadenar un 'RangeError: Maximum call stack size exceeded' con una peque\u00f1a carga \u00fatil (~2\u201310 KB). El `RangeError` no es un `YAMLParseError`, por lo que las aplicaciones que solo capturan errores espec\u00edficos de YAML encontrar\u00e1n un tipo de excepci\u00f3n inesperado. Dependiendo del manejo de excepciones de la aplicaci\u00f3n anfitriona, esto puede hacer que fallen las solicitudes o terminar el proceso de Node.js. Las secuencias de flujo permiten un anidamiento profundo con bytes m\u00ednimos (2 bytes por nivel: uno '[' y uno ']'). En la pila predeterminada de Node.js, aproximadamente 1,000\u20135,000 niveles de anidamiento (entrada de 2\u201310 KB) agotan la pila de llamadas. El umbral exacto depende del entorno (versi\u00f3n de Node.js, tama\u00f1o de la pila, profundidad de la pila de llamadas en la invocaci\u00f3n). Nota: el `Parser` de la biblioteca (fase CST) utiliza un enfoque iterativo basado en pila y no se ve afectado. Solo la fase de composici\u00f3n/resoluci\u00f3n utiliza recursi\u00f3n real de la pila de llamadas. Las tres API de an\u00e1lisis p\u00fablicas se ven afectadas: `YAML.parse()`, `YAML.parseDocument()` y `YAML.parseAllDocuments()`. Las versiones 1.10.3 y 2.8.3 contienen un parche."}], "lastModified": "2026-04-02T18:11:37.490", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eemeli:yaml:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "0017D58C-8426-4E52-8EF6-304204D6A019", "versionEndExcluding": "1.10.3", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:eemeli:yaml:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "BE3E24F7-D558-4862-8B10-EE0D04D0179A", "versionEndExcluding": "2.8.3", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}