REDHAT-BUG-2498122: High severity npm/js-yaml vulnerability
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
js-yamlto a version that resolves this vulnerability.Fixed in 3.15.0 - Upgrade
Upgrade
js-yamlto a version that resolves this vulnerability.Fixed in 4.3.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2498122?
The severity of REDHAT-BUG-2498122 is rated as high with a score of 7.
How do I fix REDHAT-BUG-2498122?
To fix REDHAT-BUG-2498122, update js-yaml to version 3.15.0 or later, or to version 4.3.0 or later.
What software is affected by REDHAT-BUG-2498122?
The affected software for REDHAT-BUG-2498122 is the js-yaml package used in JavaScript for parsing and dumping YAML.
What kind of problem does REDHAT-BUG-2498122 cause?
REDHAT-BUG-2498122 causes a performance issue where CPU time may increase quadratically when parsing specific YAML documents.
When was REDHAT-BUG-2498122 published?
REDHAT-BUG-2498122 was published on July 8, 2026.