js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.
CVE-2026-84375
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-84375
js-yaml
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "nodeca",
"product": "js-yaml",
"versions": [
{
"status": "affected",
"version": ">= 3.0.0, < 3.15.2"
},
{
"status": "affected",
"version": ">= 4.0.0, < 4.3.2"
},
{
"status": "affected",
"version": ">= 5.0.0, < 5.4.1"
}
]
}
]- Related CVEs
- CVE-2026-84375
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #3348 · Revision 1
- Added to Heist Feed
- Publisher date