The vulnerability occurs within the yaml library used by Node.js applications. During YAML compose and resolve, a recursive function lacks depth limits, allowing an attacker who can supply YAML to trigger a stack overflow. This manifests as a RangeError: Maximum call stack size exceeded. Because the error is not a YAMLParseError, applications that only catch YAML‑specific errors may not handle it, leading to unhandled exceptions that can terminate the Node.js process or simply return a failed request. The result is a denial of service or, in worst cases, a crash that may expose runtime data.

Affected is the eemeli:yaml library, the YAML parser and serializer for JavaScript. All public parsing methods – YAML.parse(), YAML.parseDocument(), and YAML.parseAllDocuments() – are impacted. Versions on the 1.x branch prior to 1.10.3 and on the 2.x branch prior to 2.8.3 have the flaw; patch releases 1.10.3 and 2.8.3 contain the fix. Any application that processes user‑supplied YAML using an older version is at risk.

The CVSS score of 4.3 reflects medium severity, and the EPSS value (<1%) indicates a low likelihood of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker only needs to send a maliciously nested YAML document, which can be as small as 2–10 KB, and it will trigger the overflow during parsing. Since the stack depth threshold is about 1,000–5,000 nested levels, exploitation is straightforward once the payload is received. The impact is confined to the process parsing the YAML, meaning remote or local control of the upstream endpoint can cause service interruption.