security: CVE-2026-33532 - yaml - stack overflow DoS in @archastro/channel-harness

[calvin-archastro]

CVE-2026-33532 — yaml Stack Overflow DoS

CVE: CVE-2026-33532
Advisory: GHSA-48c2-rrv3-qjmp

---

Package

• Package: yaml (npm)
• Current constraint: ^2.4.0 (in packages/channel-harness/package.json)
• Vulnerable range: >=2.0.0 <2.8.3
• Fixed version: 2.8.3
• Severity: MODERATE (CVSS 3.1: 4.3)

---

Impact

Parsing a deeply nested YAML document triggers a RangeError: Maximum call stack size exceeded in the compose/resolve phase. A ~2–10 KB payload can crash the Node.js process.

@archastro/channel-harness uses yaml to parse OpenAPI specs with x-channels extensions. If user-controlled YAML reaches this path, a DoS is possible.

The lockfile in this repo already resolves to yaml@2.8.3 (patched). However, the declared ^2.4.0 constraint allows downstream consumers to resolve to a vulnerable version.

Same CVE was filed against ArchAstro/firstlanding as issue #5248.

---

Affected Code

• packages/channel-harness/package.json — "yaml": "^2.4.0"
• packages/channel-harness/src/spec/loader.ts — YAML parsing of OpenAPI spec files

---

Triage Reasoning

Escalating because this is a published package (@archastro/channel-harness). The constraint must be updated and a new version published so downstream consumers get the fix.

---

Recommended Action

1. Bump packages/channel-harness/package.json: "yaml": "^2.4.0" → "yaml": "^2.8.3"
2. Run npm install to regenerate lockfile
3. Publish a patch release of @archastro/channel-harness

---

Mitigations in Place

• Lockfile already pins yaml@2.8.3 — CI/CD using the checked-in lockfile is patched
• channel-harness is primarily used as a devDependency / testing tool, reducing runtime exposure
• YAML inputs in normal usage are developer-controlled spec files, not user-controlled data

---

Filed by Security Triage Agent — scheduled scan 2026-05-16T22:00:00Z

[calvin-archastro]

Security Triage Update — 2026-05-16 23:00 scan

The ws dependency in packages/channel-harness/package.json has been updated since this issue was filed. The constraint is now "ws": "^8.18.0", which exceeds the patched minimum of 8.17.1. CVE-2024-37890 is resolved for ws in this package.

The remaining open finding here is CVE-2026-33532 (yaml: "^2.4.0" — lockfile resolves to 2.8.3 which is patched, but source constraint still allows vulnerable versions for downstream consumers). That remains the blocker for closing this issue.

— Security Triage Agent

[calvin-archastro]

Scheduled scan — 2026-05-17 | Still unfixed.

Both packages/channel-harness/package.json and packages/sdk-generator/package.json still declare yaml: "^2.4.0". Vulnerable range: 2.0.0–2.8.2. Fix: bump both constraints to ^2.8.3.

No change since last scan. Tracking open.

[calvin-archastro]

🔁 Automated scan update — 2026-05-17T01:00Z

Still unresolved. Both packages/channel-harness/package.json and packages/sdk-generator/package.json still declare yaml: "^2.4.0". Note: ws was previously updated to ^8.18.0 in channel-harness (CVE-2024-37890 resolved for that package).

Fix: bump yaml to "^2.8.3" in both channel-harness and sdk-generator package.json files.

[calvin-archastro]

🤖 Security Scan — 2026-05-17T02:00Z (hourly check-in)

yaml still at ^2.4.0 in both packages/channel-harness/package.json and packages/sdk-generator/package.json. CVE-2026-33532 (MODERATE DoS) unresolved.

ws in channel-harness is now ^8.18.0 — that sub-finding is resolved. Only the yaml issue remains open for this repo.

[calvin-archastro]

Security Agent automated scan — 2026-05-17T03:00Z

Partial progress noted: packages/channel-harness/package.json now has "ws": "^8.18.0" ✅ — CVE-2024-37890 (ws) is resolved in channel-harness.

Still open: Both packages/channel-harness/package.json and packages/sdk-generator/package.json still have "yaml": "^2.4.0". CVE-2026-33532 (yaml stack overflow DoS, MODERATE) remains unfixed in both packages. Please bump yaml to ^2.8.3 in both.

This is the hourly automated monitoring comment.

[calvin-archastro]

Security scan update — 2026-05-17 04:00 UTC

Both packages/channel-harness/package.json and packages/sdk-generator/package.json still have "yaml": "^2.4.0". CVE-2026-33532 remains unpatched. Note: ws in channel-harness is now ^8.18.0 (CVE-2024-37890 resolved there). Attempting automated fix PR now.

[calvin-archastro]

Security scan update — 2026-05-17 04:00 UTC

Automated fix attempted again but create_branch tool is failing with an infrastructure error (2nd consecutive scan). The fix is a simple one-line change in each file:

• packages/channel-harness/package.json: bump "yaml": "^2.4.0" → "yaml": "^2.8.3"
• packages/sdk-generator/package.json: bump "yaml": "^2.4.0" → "yaml": "^2.8.3"

yaml@2.8.3 is the patched version. Both packages already list ws: ^8.18.0 (channel-harness) — no ws issue here. Please apply the yaml bumps manually.

[calvin-archastro]

⏰ Automated staleness check — 2026-05-17T05:00

Both packages still have "yaml": "^2.4.0" (CVE-2026-33532, MODERATE DoS):

• packages/channel-harness/package.json
• packages/sdk-generator/package.json

Note: ws in channel-harness is already "^8.18.0" ✅ — only yaml remains.

Automated branch creation is failing due to an infrastructure error in the Security Agent tooling (create_branch tool broken for 3+ consecutive scans). This cannot be auto-fixed until the tool is restored.

Manual fix required:

# In archastro-openapi repo root:
git checkout -b security/fix-CVE-2026-33532-yaml
# Edit packages/channel-harness/package.json: "yaml": "^2.4.0" → "^2.8.3"
# Edit packages/sdk-generator/package.json: "yaml": "^2.4.0" → "^2.8.3"
npm install
git commit -am "fix(security): CVE-2026-33532 bump yaml to ^2.8.3 in channel-harness and sdk-generator"
git push origin security/fix-CVE-2026-33532-yaml
# Open PR against main

— Security Agent automated scan

[calvin-archastro]

🟡 Security Agent — Staleness check 2026-05-17T06:00Z

Both affected files still show "yaml": "^2.4.0":

• packages/channel-harness/package.json
• packages/sdk-generator/package.json

CVE-2026-33532 remains unfixed in this repo. Per the Patch Management Standard, MODERATE severity has a 30-day SLA (filed 2026-05-16, deadline ~2026-06-15).

Action required:

# In packages/channel-harness/ and packages/sdk-generator/
npm install yaml@^2.8.3
# Commit both updated package.json files and their lockfiles

Note: ws in channel-harness is already at ^8.18.0 (CVE-2024-37890 resolved there ✅).

The create_branch infrastructure tool has been failing for multiple consecutive scans — manual fix required.

[calvin-archastro]

🔄 Automated Security Scan — 2026-05-17T07:00Z

Still unresolved. Both packages continue to declare "yaml": "^2.4.0":

• packages/channel-harness/package.json

• packages/sdk-generator/package.json

• CVE-2026-33532 | yaml stack overflow DoS | MODERATE

• Fixed in: yaml ≥ 2.8.3

• SLA deadline: ~2026-06-15 (30-day MODERATE window per Patch Management Standard)

• Time elapsed since filed: ~33 hours

Required action: Bump "yaml": "^2.4.0" → "yaml": "^2.8.3" in both package.json files, run npm install, commit updated lockfiles.

Note: The automated create_branch infrastructure tool continues to fail. Manual fix required.

This issue will be flagged again at each hourly scan until resolved.

[calvin-archastro]

🔄 Security Agent — Automated Staleness Check (2026-05-17T08:00Z)

Both packages/channel-harness/package.json and packages/sdk-generator/package.json still have "yaml": "^2.4.0" on main. CVE-2026-33532 remains unpatched.

• SLA deadline: ~2026-06-15 (MODERATE severity — 30-day remediation per Patch Management Standard)
• Fix: bump yaml to "^2.8.3" in both package manifests

⚠️ The security agent's create_branch tool has been non-functional for 5+ consecutive scans. A human must make this change manually:

# In packages/channel-harness:
npm install yaml@^2.8.3
# In packages/sdk-generator:
npm install yaml@^2.8.3
git commit -am "fix(security): CVE-2026-33532 bump yaml to ^2.8.3"
git push

[calvin-archastro]

⚠️ Security Triage Agent — Staleness Check (2026-05-17T08:00Z)

yaml: "^2.4.0" is still present in both packages/channel-harness/package.json and packages/sdk-generator/package.json. CVE-2026-33532 (MODERATE, DoS) remains unpatched in the source constraint.

Note: ws in channel-harness is already on ^8.18.0 (patched for CVE-2024-37890) — that's resolved.

SLA deadline: ~2026-06-15 (30 days from filing per MODERATE severity patch management standard).

Automated branch creation continues to fail (6+ consecutive scans). Manual fix needed:

# In ArchAstro/archastro-openapi
# Edit packages/channel-harness/package.json: "yaml": "^2.8.3"
# Edit packages/sdk-generator/package.json:   "yaml": "^2.8.3"
npm install && git commit -am "fix(security): CVE-2026-33532 upgrade yaml ^2.4.0 -> ^2.8.3"

~29 days remain before SLA breach.

[calvin-archastro]

Security Agent staleness check — 2026-05-17T09:00Z

packages/sdk-generator/package.json still has "yaml": "^2.4.0" on main. packages/channel-harness/package.json also still has "yaml": "^2.4.0".

CVE-2026-33532 (yaml stack overflow DoS) remains unpatched in both packages.

Note: channel-harness ws is already "^8.18.0" ✅ — that part is resolved.

Fix needed: bump yaml to ^2.8.0 or later in both packages/channel-harness/package.json and packages/sdk-generator/package.json.

— Security Triage Agent, 2026-05-17T09:00Z

[calvin-archastro]

🤖 Security Triage Agent — Automated Check (2026-05-17T10:00Z)

Status: STILL VULNERABLE — yaml remains at "^2.4.0" in both packages/channel-harness/package.json and packages/sdk-generator/package.json.

Note: ws in channel-harness is now "^8.18.0" ✅ — CVE-2024-37890 resolved in this package.

SLA Status: MODERATE severity — 30-day remediation window. Filed 2026-05-16T22:03Z → deadline ~2026-06-15. ~29 days remaining.

Fix: Bump "yaml": "^2.4.0" → "^2.8.3" in both affected package.json files.

This is the automated 10:00 UTC check.

[calvin-archastro]

🤖 Security Agent Automated Check — 2026-05-17T11:00Z

Status: STILL UNRESOLVED — yaml "^2.4.0" confirmed in both packages/channel-harness/package.json and packages/sdk-generator/package.json as of this scan.

Deadline: ~2026-06-15 (MODERATE severity per Patch Management Standard = 30-day remediation window). ~29 days remain.

Note: ws in packages/channel-harness/package.json is "^8.18.0" ✅ — the ws CVE is NOT present here.

Required action: Bump "yaml" from "^2.4.0" → "^2.7.0" (or latest 2.x patched version) in both:

• packages/channel-harness/package.json
• packages/sdk-generator/package.json

⚠️ The Security Agent's automated create_branch tool continues to fail — auto-fix PR cannot be created. Human must apply this fix manually.

"yaml": "^2.7.0"