chore: update dependency yaml to v2.8.3 [security] by renovate[bot] · Pull Request #1593 · loopbackio/loopback4-example-shopping

renovate · 2023-05-26T17:03:14Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
yaml (source)	`2.1.1` → `2.8.3`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Uncaught Exception in yaml

CVE-2023-2251 / GHSA-f9xv-q969-pqx4

More information

Details

Uncaught Exception in GitHub repository eemeli/yaml starting at version 2.0.0-5 and prior to 2.2.2.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

CVE-2026-33532 / GHSA-48c2-rrv3-qjmp

More information

Details

Parsing a YAML document with yaml may throw a RangeError due to a stack overflow.

The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a RangeError: Maximum call stack size exceeded with a small payload (~2–10 KB). The RangeError is not a YAMLParseError, so applications that only catch YAML-specific errors will encounter an unexpected exception type. Depending on the host application's exception handling, this can fail requests or terminate the Node.js process.

Flow sequences allow deep nesting with minimal bytes (2 bytes per level: one [ and one ]). On the default Node.js stack, approximately 1,000–5,000 levels of nesting (2–10 KB input) exhaust the call stack. The exact threshold is environment-dependent (Node.js version, stack size, call stack depth at invocation).

Note: the library's Parser (CST phase) uses a stack-based iterative approach and is not affected. Only the compose/resolve phase uses actual call-stack recursion.

All three public parsing APIs are affected: YAML.parse(), YAML.parseDocument(), and YAML.parseAllDocuments().

PoC

const YAML = require('yaml');

// ~10 KB payload: 5000 levels of nested flow sequences
const payload = '['.repeat(5000) + '1' + ']'.repeat(5000);

try {
  YAML.parse(payload);
} catch (e) {
  console.log(e.constructor.name); // RangeError (NOT YAMLParseError)
  console.log(e.message);          // Maximum call stack size exceeded
}

Test environment: Node.js v24.12.0, macOS darwin arm64

Version	Nesting Depth	Input Size	Result
1.0.0	5,000	10,001 B	RangeError
1.10.2	5,000	10,001 B	RangeError
2.0.0	5,000	10,001 B	RangeError
2.8.2	5,000	10,001 B	RangeError
2.8.3	5,000	10,001 B	YAMLParseError

Depth threshold on yaml 2.8.2:

Nesting Depth	Input Size	Result
500	1,001 B	Parses successfully
1,000	2,001 B	RangeError (threshold varies by stack size)
5,000	10,001 B	RangeError

Severity

CVSS Score: 4.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

eemeli/yaml (yaml)

Uh oh!

Conversation

renovate Bot commented May 26, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uncaught Exception in yaml

Details

Severity

References

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

Details

PoC

Severity

References

Release Notes

Custom Tag Improvements

TypeScript Improvements

Other New Features

Bugfixes

New Features

Bugfixes

Configuration

Uh oh!

renovate Bot commented Aug 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: packages/shopping/package-lock.json

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented May 26, 2023 •

edited

Loading

renovate Bot commented Aug 10, 2025 •

edited

Loading