Executive brief
js-yaml is a popular YAML parser for JavaScript. The parser's protection against CPU-intensive merge operations has a flaw: it does not count empty merge sources against its merge limit, allowing attackers to craft small YAML files that trigger quadratic-time processing and exhaust CPU resources. An attacker can cause prolonged processing delays or service unavailability with a relatively small malicious YAML document.
Technical details
The vulnerability is an algorithmic complexity flaw in js-yaml's YAML merge (<<) operation. The maxTotalMergeKeys guard, intended to prevent quadratic-time merge DoS, counts only merge sources that fold keys. Empty mappings cost real iteration work but never increment the counter, allowing bypass. When a sequence of N empty mappings is aliased into K merge targets using the YAML merge operator, the parser performs O(N*K) iterations while totalMergeKeys remains unchanged. With merge enabled (YAML 1.1 schema, default in v3 and v4), a ~500 KB document with N=K=20000 empty mappings causes ~13 seconds of CPU load and scales quadratically. The fix counts each merge-source mapping as one budget unit regardless of whether it contains keys. Patches are available in v3.15.2 and v4.3.2; versions 3.0.0–3.15.1 and 4.0.0–4.3.1 are affected.
Affected products
- nodeca js-yaml 3.0.0 through 3.15.1, 4.0.0 through 4.3.1
Timeline
- 2026-09-08: disclosed: Advisory published
- 2026-09-08: patched: Patches released in v3.15.2 and v4.3.2
References
- https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh
- https://github.com/nodeca/js-yaml/pull/797
- https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639
- https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480
- https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b
- https://github.com/nodeca/js-yaml