Description
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.
Published: 2026-09-01
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (CPU exhaustion)
Action: Patch Now
AI Analysis

Impact

js-yaml is a JavaScript library that parses and emits YAML. Between releases 3.0.0 and 3.15.2, 4.3.2, and 5.4.1, the maxTotalMergeKeys counter in lib/js-yaml/loader.js and lib/loader.js fails to count empty mapping sources during merge-key processing. An attacker can alias a large sequence of empty mappings into many merge targets, leading to an O(N × K) workload even though totalMergeKeys never hits the configured limit. As a result, a relatively small YAML document can provoke sustained CPU consumption in any application that parses untrusted YAML, because merge processing is enabled by default on these releases. The flaw is fixed in the mentioned newer versions.

Affected Systems

The vulnerability affects the Nodeca js‑yaml library. All releases from 3.0.0 through 3.15.1, from 4.0.0 through 4.3.1, and version 5.4.1 have the bug. The issue was addressed in releases 3.15.2, 4.3.2, and 5.4.1.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity. The EPSS score of 0.00529 (0.53%) shows a low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. An attacker can exploit this by supplying a malicious YAML document to any application that parses YAML with js‑yaml, which is plausible for both local data ingestion and remote input if the application accepts untrusted YAML. The likely attack vector is via crafted YAML input that triggers the merge processing overhead, producing prolonged CPU consumption.

Generated by OpenCVE AI on September 28, 2026 at 22:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade js‑yaml to version 3.15.2 or newer, or 4.3.2 or newer, to apply the fix that correctly limits merge key processing.
  • If an upgrade is not immediately possible, configure the library to disable merge key handling or reject YAML content that triggers large merge operations, if such configuration is available.
  • Apply system‑level resource controls such as CPU limits or monitoring to detect and contain excessive CPU usage by applications that use js‑yaml.

Generated by OpenCVE AI on September 28, 2026 at 22:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-2883-xcg3-v3hh js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
History

Mon, 28 Sep 2026 21:45:00 +0000

Type Values Removed Values Added
Description js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. This issue is fixed in versions 3.15.2 and 4.3.2. js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.
References

Wed, 02 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 02 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-835
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 02 Sep 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Nodeca
Nodeca js-yaml
Vendors & Products Nodeca
Nodeca js-yaml

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. This issue is fixed in versions 3.15.2 and 4.3.2.
Title js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
Weaknesses CWE-400
CWE-407
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Nodeca Js-yaml
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-28T21:32:39.387Z

Reserved: 2026-09-01T16:27:58.129Z

Link: CVE-2026-84375

cve-icon Vulnrichment

Updated: 2026-09-02T13:43:51.973Z

cve-icon NVD

Status : Deferred

Published: 2026-09-01T22:17:19.440

Modified: 2026-09-28T22:17:33.377

Link: CVE-2026-84375

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-01T21:43:13Z

Links: CVE-2026-84375 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T23:00:07Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-407

    Inefficient Algorithmic Complexity

  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')