CVE-2026-84375

Deferred Deferred - Pending Action

Denial of Service in js-yaml via Merge Key Processing

Publication date: 2026-09-01

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-28

Generated

2026-10-12

AI Q&A

2026-09-02

EPSS Evaluated

2026-10-11

NVD

CVE-2026-84375

Affected Vendors & Products

Vendor	Product	Version / Range
js-yaml	js-yaml	From 3.0.0 (inc) to 3.15.2 (inc)
js-yaml	js-yaml	From 4.3.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability affects the js-yaml library versions between 3.0.0 and 3.15.2, and 4.3.2. It involves improper handling of merge keys in YAML parsing, where an attacker can exploit empty mappings to cause excessive CPU usage during processing.

Detection Guidance

This vulnerability can be detected by checking the version of js-yaml in use. If your application uses js-yaml versions between 3.0.0 and 3.15.1 or 4.0.0 and 4.3.1, it is vulnerable. Run commands like 'npm list js-yaml' or 'yarn list js-yaml' to check the installed version.

Impact Analysis

An attacker could send a specially crafted YAML document to applications using vulnerable versions of js-yaml, causing high CPU consumption and potentially leading to denial-of-service conditions.

Compliance Impact

This vulnerability causes prolonged CPU consumption due to inefficient processing of YAML documents with merge keys. While it does not directly expose data, it may lead to denial-of-service conditions in applications parsing untrusted YAML. This could impact compliance by disrupting availability requirements under standards like GDPR (data processing integrity) and HIPAA (system availability for protected health information).

Mitigation Strategies

Update js-yaml to version 3.15.2 or later for the 3.x line, or 4.3.2 or later for the 4.x line. This fixes the issue by properly counting empty mapping sources during merge key processing.

Hi! I’m here to help you understand CVE-2026-84375. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70