Executive brief
The js-yaml library, a popular tool for parsing YAML data in Node.js applications, is vulnerable to a denial-of-service attack. An attacker can provide a specially crafted YAML file that causes the application to consume excessive system resources or stop responding. This can lead to service outages and prevent legitimate users from accessing the application.
Technical details
Versions of js-yaml prior to 3.13.0 are vulnerable to a Denial of Service (DoS) via resource exhaustion. The vulnerability occurs when the parser processes complex arrays used as map keys. By utilizing YAML aliases and anchors to create deeply nested structures, an attacker can cause the output string representation of a key to grow exponentially relative to a linear input (similar to a 'Billion Laughs' attack). This results in the Node.js process stalling or exhausting memory. The issue was addressed by restricting the data types allowed for object keys in the `storeMappingPair` function.
Affected products
- nodeca js-yaml < 3.13.0
Timeline
- 2019-03-18: disclosed: Vulnerability disclosed by researchers
- 2019-03-20: patched: Fix committed to repository
- 2019-06-05: advisory: GitHub advisory published