Description

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. This issue is fixed in versions 3.15.2 and 4.3.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-01T22:17:19.440Z",
  "pubdate": "2026-09-01T22:17:19.440Z",
  "executiveSummary": "The js-yaml library is susceptible to a Denial of Service (DoS) vulnerability due to improper input validation during the processing of YAML merge keys (<<).\nThe vulnerability type is categorized as an algorithmic complexity attack, specifically a resource exhaustion issue leading to excessive CPU consumption.\nAffected products include js-yaml versions from 3.0.0 up to 3.15.2 and 4.3.2.\nThe impact involves the potential for prolonged service unavailability as the parser performs redundant O(N * K) operations when processing malicious YAML documents.\nThe risk is high for applications that accept untrusted YAML input where merge processing is enabled by default.\nAn attacker can exploit this by crafting a relatively small YAML document containing deeply nested or aliased empty mapping sources, effectively bypassing existing resource limits intended to restrict totalMergeKeys.\nNo specific authentication or high-level privileges are required to trigger this vulnerability, making it accessible to any remote actor capable of submitting YAML payloads to an application utilizing the affected library versions.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the merge key (<<) logic within lib/js-yaml/loader.js and lib/loader.js. The parser utilizes a counter, maxTotalMergeKeys, to track and limit the complexity of merge operations within a YAML document. However, the logic fails to account for empty mapping sources during the resolution process.\nIn a standard YAML merge operation, the parser tracks how many times the merge key is used to prevent abuse. Because the implementation neglects to increment the counter for empty mappings, an attacker can create a chain of YAML aliases referring to empty mappings. By repeatedly aliasing a large sequence of these empty mappings into multiple merge targets, the attacker forces the parser into a redundant processing loop.\nThe attack flow begins with the submission of a maliciously crafted YAML document to an application using a vulnerable version of js-yaml. When the loader encounters the merge key, it begins resolving the aliases. Because empty mappings do not trigger the maxTotalMergeKeys limit, the parser proceeds to compute the merge for every aliased instance. This leads to an O(N * K) computational complexity, where N represents the number of objects and K represents the depth or number of merges requested.\nSince the counter never exceeds the configured threshold, the parser does not terminate, allowing the CPU usage of the process to spike significantly. This effectively stalls the event loop in Node.js environments. The exploitation is highly efficient because the payload size remains small while the computational overhead required for resolution is disproportionately high.\nThis vulnerability is present in versions 3.0.0 through 3.15.2 and 4.3.2. As the library is commonly used in server-side JavaScript applications to parse configuration files, API payloads, or user-provided settings, the potential for widespread service disruption is significant. The behavior is inherent to the parser's logic; therefore, it does not require specialized privileges, and the exploitation is triggered automatically upon document parsing if merge key support is enabled, which is the default configuration for these release lines."
}