CVE-2026-84375
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
js-yaml, a JavaScript YAML parser and dumper, from 3.0.0 until 3.15.2 and 4.3.2, has a vulnerability in maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js that does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default.
Risk Assessment
The vulnerability can lead to DoS attacks via excessive CPU consumption, potentially slowing down or crashing applications that process untrusted YAML data.
Recommendation
It is recommended to update js-yaml to version 3.15.2 or 4.3.2, which contain the fix. If not possible, consider disabling merge processing or restricting YAML data sources.
Other vulnerabilities in js-yaml
See all- CVE-2026-73643High
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. Fixed in version 5.2.2.
- CVE-2026-59870Medium
A vulnerability in the js-yaml library (versions 5.0.0 through 5.2.0) causes excessive CPU consumption when parsing a crafted YAML document with the !!omap tag. The omapTag.addItem() function performs a linear duplicate-key scan on every insertion, resulting in O(n^2) computational complexity.
- CVE-2026-59869High
A vulnerability in the js-yaml library (JavaScript YAML parser and dumper) causes quadratic CPU time growth when processing YAML documents containing a chain of mappings with merge keys. The issue affects versions from 3.0.0 to 3.14.0 and from 4.0.0 to 4.2.0.
- CVE-2026-59868Medium
A vulnerability in the js-yaml library (versions 5.0.0 through 5.2.0) causes quadratic CPU time when parsing YAML documents with merge keys enabled. A chain of mappings where each entry merges the previous one leads to excessive CPU load.
- CVE-2026-53550Medium
A vulnerability in js-yaml (YAML parser for JavaScript) before versions 4.2.0 and 3.15.0 allows a DoS attack via a crafted YAML document that causes quadratic time complexity during merge-key (<<) processing. Repeatedly using the same alias in a merge sequence leads to CPU exhaustion and blocks the Node.js event loop for seconds with a relatively small payload (tens of KB).
Original NVD description (English source)
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. This issue is fixed in versions 3.15.2 and 4.3.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS