Executive brief
js-yaml is a popular YAML parser used across many Node.js applications for configuration and data parsing. An attacker can exploit a flaw in how the library handles YAML merge keys to force excessive CPU consumption during parsing, allowing them to disable applications or services by providing specially crafted YAML documents that take quadratic time to process.
Technical details
The vulnerability is a resource exhaustion (CWE-400) in js-yaml's YAML merge key (`<<`) handling. When processing chained mappings where each mapping merges the previous one via the merge key operator, the parser must enumerate all inherited keys for each new mapping, resulting in O(N²) CPU time for O(N) input size. The attack requires no authentication or user interaction—any network-reachable application that parses untrusted YAML with js-yaml versions 3.0.0–3.14.x or 4.0.0–4.2.x is vulnerable. The fix (versions 3.15.0 and 4.3.0) introduces a `maxTotalMergeKeys` option (default 10,000) that limits the total number of keys processed via merge operations in a single parse call.
Affected products
- nodeca js-yaml 3.0.0 to 3.14.x, 4.0.0 to 4.2.x
Timeline
- 2026-07-20: disclosed: Advisory GHSA-52cp-r559-cp3m published
- 2026-06-26: patched: Fix committed with maxTotalMergeKeys option
- 2026-07-20: patched: Patches released in js-yaml 3.15.0 and 4.3.0
References
- https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m
- https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7
- https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4
- https://github.com/nodeca/js-yaml
- https://github.com/nodeca/js-yaml/releases/tag/3.15.0
- https://github.com/nodeca/js-yaml/releases/tag/4.3.0