Executive brief
A vulnerability in the js-yaml library, which is used to parse YAML configuration files, can allow an attacker to crash or slow down an application. By providing a specially crafted YAML file with complex 'merge key' chains, an attacker can force the system to consume excessive processor power. This can lead to a denial-of-service (DoS) condition, making the affected service unavailable to legitimate users.
Technical details
The js-yaml library (v5.x) is susceptible to an algorithmic complexity vulnerability (CWE-407) when processing YAML merge keys (<<). When merge keys are enabled, a chain of mappings where each mapping merges the previous one causes the loader to repeatedly enumerate inherited keys. This results in O(N^2) CPU work for an O(N) input size. An attacker can exploit this by submitting a relatively small YAML document (e.g., <100KB) that requires significant processing time, leading to uncontrolled resource consumption (CWE-400). The vulnerability is mitigated in version 5.2.0 by implementing a limit on the total number of merged keys per parse call.
Affected products
- nodeca js-yaml >= 5.0.0, <= 5.1.0
Timeline
- 2026-07-02: disclosed: Vulnerability published to nodeca/js-yaml
- 2026-07-08: advisory: Published to the National Vulnerability Database (NVD)
- 2026-07-20: patched: GitHub Advisory reviewed and updated with patch information