Executive brief
js-yaml is a popular JavaScript library used to read and write YAML files, commonly used in web servers and configuration tools. A vulnerability in how it handles specific data structures allows an attacker to send a small, specially crafted file that forces the server to perform excessive calculations. This can cause the application to become unresponsive or crash, leading to a denial of service for legitimate users.
Technical details
A denial-of-service vulnerability exists in js-yaml's merge-key (<<) processing within lib/loader.js. The root cause is inefficient algorithmic complexity (CWE-407) where the storeMappingPair function fails to deduplicate aliases in a merge sequence. When a YAML document repeats the same anchored alias multiple times, the parser redundantly executes mergeMappings, performing repeated Object.keys() allocations and hasOwnProperty checks. This results in O(K * M) complexity (where K is the number of keys and M is the number of merges) instead of linear scaling. An attacker can exploit this by submitting a small payload (tens of KB) to block the Node.js event loop for several seconds. The issue is resolved in version 4.2.0 by implementing reference-based deduplication during merge handling.
Affected products
- nodeca js-yaml < 4.2.0
Timeline
- 2026-05-31: advisory: GitHub Security Advisory published by maintainers
- 2026-06-22: disclosed: NVD publication date