Executive brief
A performance vulnerability in the js-yaml library, used for parsing YAML data in Node.js applications, allows an attacker to cause a denial of service. By providing a specially crafted YAML file, an attacker can force the application to consume excessive CPU resources, effectively freezing the service for all users. This issue specifically affects older but still widely used versions of the library where a previous security fix was not applied.
Technical details
The vulnerability is an inefficient algorithmic complexity issue (CWE-407) in the resolveYamlOmap() function within lib/type/omap.js. The function uses a linear scan (Array.prototype.indexOf) inside a loop to enforce key uniqueness for !!omap sequences, resulting in O(n²) time complexity relative to the number of entries. Because this occurs synchronously during yaml.load(), it blocks the Node.js event loop. This is a regression/lack of backport for the fix originally implemented in version 5.2.1 (which uses a Set for O(n) lookup). The vulnerability is reachable via the default schema without custom configuration. Patches are available in versions 3.15.1 and 4.3.1.
Affected products
- nodeca js-yaml >= 3.0.0, < 3.15.1
- nodeca js-yaml >= 4.0.0, < 4.3.1
Timeline
- 2026-07-31: patched: Patched versions 3.15.1 and 4.3.1 released
- 2026-08-06: advisory: GitHub Advisory GHSA-5p4m-2wfm-xmqj published