js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Published September 8, 2026 CVE-2026-84375

A small hostile YAML document can make vulnerable js-yaml versions consume heavy processor time. Affected applications can become unavailable to legitimate users.

Severity
HighCVSS 3.1 · 7.5
Fix
Fixed in 3.15.2Fix recorded 2 days ago
Affected versions
3.0.0 or newer, but before 3.15.2; 4.0.0 or newer, but before 4.3.2
Weakness
CWE-400Uncontrolled Resource Consumption
Exploit likelihood
0.39% in 30 daysEPSS, higher than 32% of known flaws
Affects
JS-YAML

How it works

  • The application must process YAML from an untrusted source with merge handling enabled.
  • An attacker submits a small document that repeatedly combines large groups of empty entries. js-yaml revisits every entry whenever each group is reused.
  • Empty entries do not increase its processing limit counter.
  • The resulting work can consume processor time for a prolonged period.

What to do

Run npm ls --all js-yaml inside each deployed application project. Versions from 3.0.0 through 3.15.1 and 4.0.0 through 4.3.1 are vulnerable. Exposure requires the application to process YAML supplied by an untrusted source.

Run this in the application environment you want to check:

npm ls --all js-yaml

Update the 3.x branch to 3.15.2 or the 4.x branch to 4.3.2. Repeat the package check and confirm no vulnerable copy remains in the dependency tree.

Technical details

CVE-2026-84375 affects maxTotalMergeKeys in js-yaml. Empty merge sources require processing but do not increase the safety counter. Reusing N empty groups across K targets therefore causes O(N K) work. The fix counts each empty merge source against the processing budget. The documented security impact is reduced availability from prolonged processor consumption.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact None No data disclosure
  • Integrity impact None No data tampering
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Open in FIRST.org calculator

References

View Original Source