CVE-2026-84375: js-yaml CPU Consumption Vulnerability Due to Unchecked Merge Keys
Summary
CVE-2026-84375: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources. Affects js-yaml across 2 version ranges.
>= 3.0.0, < 3.15.2
>= 4.0.0, < 4.3.2
Fixed in 3.15.2 or 4.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
js-yaml is a popular JavaScript library used for parsing and dumping YAML (YAML Ain't Markup Language) documents. It allows developers to easily convert YAML data into JavaScript objects and vice versa. The library is widely utilized in various applications for configuration files and data serialization. However, a vulnerability has been identified that allows attackers to exploit the merging feature of js-yaml, leading to excessive CPU consumption.
Vulnerability Detail
The vulnerability arises from the maxTotalMergeKeys setting in js-yaml, which does not account for empty mappings during the merging process. An attacker can create a YAML document with a large number of empty mappings, causing the parser to consume significant CPU resources without hitting the configured limit. This results in prolonged CPU usage, potentially leading to denial of service. The issue is exacerbated in versions 3.x and 4.x of the library, where merge functionality is enabled by default.
How To Fix
Latest published version: 5.5.0 as of 23 Oct 2026
npm install js-yaml@5.5.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.15.23.15.2npm install js-yaml@3.15.2 -
>= 4.0.0, < 4.3.24.3.2npm install js-yaml@4.3.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can limit the use of the merge feature in js-yaml or avoid processing untrusted YAML documents that may contain empty mappings. Additionally, consider implementing resource limits in your application to mitigate the impact of potential CPU consumption.
Conclusion
The js-yaml library has a significant vulnerability that allows for excessive CPU consumption through unchecked merge keys. It is crucial for developers using this library to update to the patched versions to ensure the security and stability of their applications. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for js-yaml →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Versions 3.0.0 to 3.15.1 and 4.0.0 to 4.3.1 of js-yaml are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can help you identify if your application is affected by this vulnerability.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, consider implementing resource limits in your application to mitigate the impact of potential CPU consumption from this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for js-yaml.
