Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 6 August 2026.

Which products and versions are affected?

js-yaml (npm) SEMVER:introduced=4.0.0,fixed=4.3.1.

Is there a fix for This vulnerability?

Yes. js-yaml (npm): upgrade to 4.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run js-yaml (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

JS-YAML quadratic CPU consumption in !!omap resolution

Severity: low · CVSS 3.1 · Published 2026-08-06

JS-YAML is a widely-used JavaScript library for parsing YAML configuration files and data. Versions 3.x and 4.x contain a performance flaw in the ordered-map feature that allows an attacker to craft a YAML file causing the parser to consume excessive CPU time, blocking the application and affecting all concurrent requests. The vulnerability requires no authentication and can be exploited by sending a modestly-sized malicious YAML document, making it a serious denial-of-service risk for any service that accepts untrusted YAML input.

Technologies: js-yaml (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 6 August 2026.
Which products and versions are affected?: js-yaml (npm) SEMVER:introduced=4.0.0,fixed=4.3.1.
Is there a fix for This vulnerability?: Yes. js-yaml (npm): upgrade to 4.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run js-yaml (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

js-yaml (npm): upgrade to 4.3.1 or later
```
npm install js-yaml@4.3.1
```

Technical details

The vulnerability exists in lib/type/omap.js where the resolveYamlOmap() function validates key uniqueness using Array.prototype.indexOf() inside a loop that iterates over each map entry. This creates O(n²) time complexity: as objectKeys array grows, each subsequent indexOf() call performs a linear scan, resulting in roughly 1+2+...+n comparisons for an n-entry !!omap. The !!omap type is enabled by default in the default schema, requiring no special configuration. The synchronous nature of yaml.load() means the CPU consumption blocks the Node.js event loop, stalling all concurrent requests in a process. The fix, already deployed in js-yaml 5.2.1+, replaces the linear scan with a Set-based lookup (O(1) per operation, O(n) overall). Versions 3.15.0 and 4.3.0 remain affected despite being the latest in their respective lines.

Affected products

js-yaml js-yaml 3.0.0 to 3.15.0
js-yaml js-yaml 4.0.0 to 4.3.0

Timeline

2026-07-31: disclosed: Advisory published by js-yaml maintainers
2026-08-06: patched: js-yaml 3.15.1 and 4.3.1 released with fixes
2026-05-01: other: Same weakness fixed in js-yaml 5.2.1 but fix never backported to 3.x and 4.x

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.