Potential Security Vulnerability Detected

Repository: nodejs/node
Commit: 8abe6a2
Author: dependabot[bot]
Date: 2026-03-31T07:46:18Z

Commit Message

tools: bump yaml from 2.8.2 to 2.8.3 in /tools/doc

Bumps [yaml](https://github.com/eemeli/yaml) from 2.8.2 to 2.8.3.
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](https://github.com/eemeli/yaml/compare/v2.8.2...v2.8.3)

---
updated-dependencies:
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/62437
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Pull Request

PR: #62437 - tools: bump yaml from 2.8.2 to 2.8.3 in /tools/doc
Labels: doc, tools, dependencies, javascript

Description:
Bumps [yaml](https://github.com/eemeli/yaml) from 2.8.2 to 2.8.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="iframe.php?url=https%3A%2F%2Fgithub.com%2F%3Ca+href%3D"https://github.com/eemeli/yaml/releases%22&gt;yaml's">https://github.com/eemeli/yaml/releases"&gt;yaml's releases</a>.</em></p>
<blockquote>
<h2>v2.8.3</h2>
<ul>
<li>Add <code>trailingComma</code> ToString option for multiline flow formatting (<a href="iframe.php?url=https%3A%2F%2Fgithub.com%2F%3Ca+href%3D"https://redirect.github.com/eemeli/yaml/issues/670%22&gt;#670&lt;/a&gt;)&lt;/li">https://redirect.github.com/eemeli/yaml/issues/670"&gt;#670&lt;/a&gt;)&lt;/li>
<li>Catch stack overflow during node composition (1e84ebb)</li>
</ul>
</blockquote>
</details>
<det...

Analysis

Vulnerability Type: Denial of Service (Stack Overflow)
Severity: Medium

Description

The yaml library before 2.8.3 was vulnerable to a stack overflow during node composition when parsing deeply nested or recursive YAML structures. An attacker could craft a malicious YAML document that causes the parser to recurse deeply enough to exhaust the call stack, crashing the Node.js process. The fix adds stack overflow detection during node composition.

Affected Code

yaml 2.8.2 node composition code (compose/compose-node.ts) - recursive node composition without depth/stack overflow protection

Proof of Concept

const yaml = require('yaml');
// Craft deeply nested YAML that causes stack overflow
let malicious = '';
for (let i = 0; i < 100000; i++) malicious += '- ';
malicious += 'x';
yaml.parse(malicious); // Crashes Node.js with 'Maximum call stack size exceeded'

This issue was automatically created by Vulnerability Spoiler Alert.
Detected at: 2026-03-31T08:11:46.317Z