yaml is vulnerable to Stack Overflow via deeply nested YAML collections

Description

Parsing a YAML document with yaml may throw a RangeError due to a stack overflow.

The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a RangeError: Maximum call stack size exceeded with a small payload (~2–10 KB).

Recommendation

Update the yaml package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 1.0.0, < 1.10.3

  >= 2.0.0, < 2.8.3**

• Patched version(s): **1.10.3

  2.8.3**

References

• GHSA-48c2-rrv3-qjmp
• CVE-2026-33532
• CWE-674
• CAPEC-310
• OWASP 2021-A6