CVE-2026-73643

CVE-2026-73643 is a complexity-attack vulnerability in js-yaml affecting versions 5.0.0 through 5.2.2. The root cause is the `restoreState` mechanism introduced in 5.0.0, which allows the parser to backtrack and retry parsing when it encounters a flow-sequence entry that resembles a key:value pair. This design enables legitimate error recovery, but creates an exponential blowup path: nested flow sequences of the same shape cause every recursive level to re-parse, compounding exponentially. A mere 200-byte input can occupy a CPU core for minutes. This isn't a missing guard or a bad security check — it's an architectural artifact. The parser prioritizes flexibility over complexity containment, and the backtracking logic has no depth bounds. The vulnerability was exploitable for years before detection, despite the library's millions of weekly downloads, because the test suite likely checked only that valid YAML parsed correctly — not that malformed-but-valid-looking input terminated in reasonable time. Standard fuzzing wouldn't catch this unless specifically targeted at complexity patterns. The patch in 5.2.2 adds depth limiting or restructures the state machine, but the deeper problem is structural. YAML parsers across multiple languages — Ruby Psych, Perl YAML, Go yaml.v1 — have exhibited the same genetic sequence: backtracking, flow constructs, exponential state re-entry. This is a predictable output of parser architectures that prioritize retry-flexibility over complexity bounds, and it will recur in future parsers unless the ecosystem treats algorithmic complexity defense as a first-class requirement. For defenders: upgrade to 5.2.2 or later immediately. If you cannot upgrade, apply input size and depth limits before passing YAML to js-yaml, and wrap parsing in a timeout. Be aware that the library provides no built-in complexity guardrails — the 'load' name does not warn that untrusted input can trigger CPU exhaustion. This is a systemic exposure in the most common Node.js YAML parser, not an edge case.

Reviewed through automated stages and approved by a human before publication.