js-yaml, a JavaScript library for parsing and emitting YAML, contains a flaw in its merge key handling. The maxTotalMergeKeys counter does not count empty mapping sources, so an attacker can create a YAML document with a large number of empty mappings that are merged into many targets. The library still performs the merge, resulting in an O(N × K) processing load while the totalMergeKeys value never reaches the configured limit. In practice, a small YAML payload can trigger sustained high CPU usage, degrading or halting application performance and effectively denying service.

The vulnerability affects the Nodeca js‑yaml library. All releases from 3.0.0 through 3.15.1 and from 4.0.0 through 4.3.1 have the bug. The issue was addressed in releases 3.15.2 and 4.3.2.

The CVSS score of 7.5 indicates high severity. No EPSS score is publicly available, and the flaw is not listed in the CISA KEV catalog. An attacker can exploit this by supplying a malicious YAML document to any application that parses YAML with js‑yaml, which is plausible for both local data ingestion and remote input if the application accepts untrusted YAML. The likely attack vector is via crafted YAML input that triggers the merge processing overhead, producing prolonged CPU consumption.