chore(deps): update dependency yaml to v2.8.3 [security] by renovate[bot] · Pull Request #4653 · cds-snc/notification-manifests

renovate · 2026-03-26T02:27:15Z

This PR contains the following updates:

Package	Change	Age	Confidence
yaml (source)	`2.8.0` → `2.8.3`

Review

Updates have been tested and work
If updates are AWS related, versions match the infrastructure (e.g. Lambda runtime, database, etc.)

GitHub Vulnerability Alerts

CVE-2026-33532

Parsing a YAML document with yaml may throw a RangeError due to a stack overflow.

The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a RangeError: Maximum call stack size exceeded with a small payload (~2–10 KB). The RangeError is not a YAMLParseError, so applications that only catch YAML-specific errors will encounter an unexpected exception type. Depending on the host application's exception handling, this can fail requests or terminate the Node.js process.

Flow sequences allow deep nesting with minimal bytes (2 bytes per level: one [ and one ]). On the default Node.js stack, approximately 1,000–5,000 levels of nesting (2–10 KB input) exhaust the call stack. The exact threshold is environment-dependent (Node.js version, stack size, call stack depth at invocation).

Note: the library's Parser (CST phase) uses a stack-based iterative approach and is not affected. Only the compose/resolve phase uses actual call-stack recursion.

All three public parsing APIs are affected: YAML.parse(), YAML.parseDocument(), and YAML.parseAllDocuments().

PoC

const YAML = require('yaml');

// ~10 KB payload: 5000 levels of nested flow sequences
const payload = '['.repeat(5000) + '1' + ']'.repeat(5000);

try {
  YAML.parse(payload);
} catch (e) {
  console.log(e.constructor.name); // RangeError (NOT YAMLParseError)
  console.log(e.message);          // Maximum call stack size exceeded
}

Test environment: Node.js v24.12.0, macOS darwin arm64

Version	Nesting Depth	Input Size	Result
1.0.0	5,000	10,001 B	RangeError
1.10.2	5,000	10,001 B	RangeError
2.0.0	5,000	10,001 B	RangeError
2.8.2	5,000	10,001 B	RangeError
2.8.3	5,000	10,001 B	YAMLParseError

Depth threshold on yaml 2.8.2:

Nesting Depth	Input Size	Result
500	1,001 B	Parses successfully
1,000	2,001 B	RangeError (threshold varies by stack size)
5,000	10,001 B	RangeError

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

CVE-2026-33532 / GHSA-48c2-rrv3-qjmp

More information

Details

Parsing a YAML document with yaml may throw a RangeError due to a stack overflow.

The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a RangeError: Maximum call stack size exceeded with a small payload (~2–10 KB). The RangeError is not a YAMLParseError, so applications that only catch YAML-specific errors will encounter an unexpected exception type. Depending on the host application's exception handling, this can fail requests or terminate the Node.js process.

Flow sequences allow deep nesting with minimal bytes (2 bytes per level: one [ and one ]). On the default Node.js stack, approximately 1,000–5,000 levels of nesting (2–10 KB input) exhaust the call stack. The exact threshold is environment-dependent (Node.js version, stack size, call stack depth at invocation).

Note: the library's Parser (CST phase) uses a stack-based iterative approach and is not affected. Only the compose/resolve phase uses actual call-stack recursion.

All three public parsing APIs are affected: YAML.parse(), YAML.parseDocument(), and YAML.parseAllDocuments().

PoC

const YAML = require('yaml');

// ~10 KB payload: 5000 levels of nested flow sequences
const payload = '['.repeat(5000) + '1' + ']'.repeat(5000);

try {
  YAML.parse(payload);
} catch (e) {
  console.log(e.constructor.name); // RangeError (NOT YAMLParseError)
  console.log(e.message);          // Maximum call stack size exceeded
}

Test environment: Node.js v24.12.0, macOS darwin arm64

Version	Nesting Depth	Input Size	Result
1.0.0	5,000	10,001 B	RangeError
1.10.2	5,000	10,001 B	RangeError
2.0.0	5,000	10,001 B	RangeError
2.8.2	5,000	10,001 B	RangeError
2.8.3	5,000	10,001 B	YAMLParseError

Depth threshold on yaml 2.8.2:

Nesting Depth	Input Size	Result
500	1,001 B	Parses successfully
1,000	2,001 B	RangeError (threshold varies by stack size)
5,000	10,001 B	RangeError

Severity

CVSS Score: 4.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

eemeli/yaml (yaml)

Preserve empty block literals (#634)

Configuration

📅 Schedule: Branch creation - "" in timezone America/Montreal, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-03-26T02:32:21Z

STAGING HELMFILE DIFF:

notify-documentation	notification-canada-ca	582     	2026-03-02 19:42:36.130263135 +0000 UTC	deployed	notify-documentation-0.1.0	1.16.0     

notify-api	notification-canada-ca	835     	2026-03-30 19:21:57.807173394 +0000 UTC	deployed	notify-api-0.1.0	1.16.0     

notify-document-download	notification-canada-ca	573     	2026-03-18 15:21:19.867323657 +0000 UTC	deployed	notify-document-download-0.1.0	1.16.0     

notify-celery	notification-canada-ca	825     	2026-03-30 19:21:57.842465065 +0000 UTC	deployed	notify-celery-0.1.0	1.16.0     

notify-admin	notification-canada-ca	946     	2026-03-27 19:41:53.516990657 +0000 UTC	deployed	notify-admin-0.1.0	1.16.0     

ingress	nginx    	549     	2025-05-15 14:57:36.207977542 +0000 UTC	deployed	nginx-ingress-1.1.2	3.4.2      

xray-daemon	xray     	548     	2025-05-15 14:57:35.773258731 +0000 UTC	deployed	aws-xray-4.0.8	3.3.12     

image-pull-secrets	kube-system	15      	2025-08-13 17:14:36.684125276 +0000 UTC	deployed	image-pull-secrets-0.1.0	1.16.0     

fb-agent	amazon-cloudwatch	292     	2025-06-23 19:25:41.628970326 +0000 UTC	deployed	fluent-bit-0.48.5	3.2.4      

aws-cloudwatch-agent	amazon-cloudwatch	222     	2026-02-03 14:27:40.981118491 +0000 UTC	deployed	aws-cloudwatch-0.1.0	1.16.0     

target-group-crds	default  	220     	2025-10-17 18:26:58.440211718 +0000 UTC	deployed	targetgroup-crds-0.1.0	1.16.0     

aws-lb-controller	kube-system	472     	2026-02-24 19:39:20.587946294 +0000 UTC	deployed	aws-load-balancer-controller-3.1.0	v3.1.0     

storage-class	kube-system	1       	2026-02-04 20:23:09.937605697 +0000 UTC	deployed	storage-class-0.1.0	1.0.0      

velero	velero   	5       	2026-02-16 14:34:14.175845 -0500 -0500	deployed	velero-11.1.1	1.17.0     

volume-snapshot-class	default  	1       	2025-11-28 20:13:11.523680083 +0000 UTC	deployed	volume-snapshot-class-1.0.0	1.0        

snapshot-controller	kube-system	1       	2025-11-28 20:13:11.588242851 +0000 UTC	deployed	snapshot-controller-1.0.0	8.0.1      

volume-snapshot-crds	default  	1       	2025-11-28 20:12:22.717270706 +0000 UTC	deployed	volume-snapshot-crds-0.1.0	1.16.0     

signoz	signoz   	24      	2026-03-06 15:20:36.81028644 +0000 UTC	deployed	signoz-0.110.0	v0.110.0   

opentelemetry-operator	signoz   	7       	2026-03-25 16:36:45.765642862 +0000 UTC	deployed	opentelemetry-operator-0.109.0	0.148.0    

signoz-k8s	signoz   	14      	2026-03-16 14:17:12.688417995 +0000 UTC	deployed	k8s-infra-0.15.0	0.139.0    

signoz-telemetry	signoz   	1       	2026-02-18 12:15:45.837728 -0500 -0500	deployed	signoz-telemetry-0.1.0	1.16.0     

signoz-importer	signoz   	42      	2026-03-16 14:08:21.914291733 +0000 UTC	deployed	signoz-importer-1.0.0	1.0        

prometheus-cloudwatch-exporter	signoz   	1       	2026-02-19 18:44:29.357736531 +0000 UTC	deployed	prometheus-cloudwatch-exporter-0.28.1	0.16.0     

Comparing release=notify-documentation, chart=charts/notify-documentation
Comparing release=notify-api, chart=charts/notify-api
Comparing release=notify-admin, chart=charts/notify-admin
Comparing release=notify-document-download, chart=charts/notify-document-download
Comparing release=notify-celery, chart=charts/notify-celery
Comparing release=k8s-event-logger, chart=/tmp/helmfile2827476571/amazon-cloudwatch/staging/k8s-event-logger/k8s-event-logger/1.1.8/k8s-event-logger
Comparing release=karpenter-crd, chart=/tmp/helmfile2827476571/karpenter/staging/karpenter-crd/karpenter-crd/1.3.2/karpenter-crd
Comparing release=karpenter, chart=/tmp/helmfile2827476571/karpenter/staging/karpenter/karpenter/1.3.2/karpenter
Comparing release=karpenter-nodepool, chart=charts/karpenter-nodepool
Comparing release=priority-classes, chart=deliveryhero/priority-class
Comparing release=secrets-store-csi-driver, chart=secrets-store-csi-driver/secrets-store-csi-driver
Comparing release=aws-secrets-provider, chart=aws-secrets-manager/secrets-store-csi-driver-provider-aws
Comparing release=reloader, chart=stakater/reloader
Comparing release=kube-state-metrics, chart=prometheus-community/kube-state-metrics
Comparing release=blazer, chart=stakater/application
Comparing release=ingress, chart=charts/nginx-ingress
Comparing release=ingress-public, chart=charts/nginx-ingress
Comparing release=xray-daemon, chart=okgolove/aws-xray
Comparing release=ipv4-geolocate, chart=charts/ipv4-geolocate
Comparing release=image-pull-secrets, chart=charts/image-pull-secrets
Comparing release=fb-agent, chart=fluent/fluent-bit
Comparing release=cert-manager, chart=jetstack/cert-manager
Comparing release=aws-cloudwatch-agent, chart=charts/aws-cloudwatch
Comparing release=target-group-crds, chart=charts/targetgroup-crds
Comparing release=aws-lb-controller, chart=eks/aws-load-balancer-controller
Comparing release=storage-class, chart=charts/storage-class
Comparing release=metrics-server, chart=metrics-server/metrics-server
Comparing release=nidhogg, chart=/tmp/helmfile2827476571/kube-system/staging/nidhogg/nidhogg/0.6.6/nidhogg
Comparing release=velero, chart=vmware-tanzu/velero
Comparing release=volume-snapshot-crds, chart=charts/volume-snapshot-crds
Comparing release=volume-snapshot-class, chart=charts/volume-snapshot-class
Comparing release=snapshot-controller, chart=charts/snapshot-controller
Comparing release=falco, chart=falco/falco
Comparing release=falco-secret, chart=charts/notify-secrets
Comparing release=vpa, chart=fairwinds-stable/vpa
Comparing release=goldilocks, chart=fairwinds-stable/goldilocks
Comparing release=signoz, chart=signoz/signoz
Comparing release=signoz-secret, chart=charts/notify-secrets
Comparing release=opentelemetry-operator, chart=opentelemetry/opentelemetry-operator
Comparing release=signoz-k8s, chart=signoz/k8s-infra
Comparing release=signoz-telemetry, chart=charts/signoz-telemetry
Comparing release=signoz-importer, chart=charts/signoz-importer
Comparing release=prometheus-cloudwatch-exporter, chart=/tmp/helmfile2827476571/signoz/staging/prometheus-cloudwatch-exporter/prometheus-cloudwatch-exporter/0.28.1/prometheus-cloudwatch-exporter

renovate bot added Dependencies Renovate labels Mar 26, 2026

renovate bot requested review from P0NDER0SA, ben851 and jimleroyer as code owners March 26, 2026 02:27

renovate bot added Dependencies Renovate labels Mar 26, 2026

renovate bot force-pushed the renovate/npm-yaml-vulnerability branch 12 times, most recently from 08d9994 to 3a36e9b Compare March 30, 2026 19:16

chore(deps): update dependency yaml to v2.8.3 [security]

672773a

renovate bot force-pushed the renovate/npm-yaml-vulnerability branch from 3a36e9b to 672773a Compare March 30, 2026 19:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency yaml to v2.8.3 [security]#4653

chore(deps): update dependency yaml to v2.8.3 [security]#4653
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-yaml-vulnerability

renovate bot commented Mar 26, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 26, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review

GitHub Vulnerability Alerts

CVE-2026-33532

PoC

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

Details

PoC

Severity

References

Release Notes

v2.8.3

v2.8.2

v2.8.1

Configuration

Uh oh!

github-actions bot commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

STAGING HELMFILE DIFF:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Mar 26, 2026 •

edited

Loading

`v2.8.3`

`v2.8.2`

`v2.8.1`

github-actions bot commented Mar 26, 2026 •

edited

Loading