REDHAT-BUG-2527118: Medium severity npm/js-yaml vulnerability

Q: Which applications are realistically exposed to this issue?

Applications that parse YAML from untrusted sources using affected js-yaml releases are exposed. Merge-key processing is enabled by default on the affected release lines, so applications do not need to explicitly enable it.

Q: What must an attacker provide to trigger the resource exhaustion?

An attacker needs to cause the application to parse a crafted YAML document. The document uses aliases to apply a large sequence of empty mappings to many merge targets, producing prolonged CPU consumption despite the configured maxTotalMergeKeys limit.

Q: Does setting maxTotalMergeKeys protect affected versions?

No. Empty mapping sources are not counted while merge keys are processed, so totalMergeKeys can remain unchanged and the configured limit may never be reached.

Q: What versions contain the fix?

The issue is fixed in js-yaml versions 3.15.2 and 4.3.2.

Published Sep 1, 2026

Updated

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. This issue is fixed in versions 3.15.2 and 4.3.2.

Affected Software

1 affected component

npm/js-yaml>=3.0.0<3.15.2, >=4.0.0<4.3.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade js-yaml to a version that resolves this vulnerability.
Fixed in 3.15.2
Upgrade
Upgrade js-yaml to a version that resolves this vulnerability.
Fixed in 4.3.2

Event History

Sep 1, 2026

Data Sourced

via Red Hat·09:51 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which applications are realistically exposed to this issue?

Applications that parse YAML from untrusted sources using affected js-yaml releases are exposed. Merge-key processing is enabled by default on the affected release lines, so applications do not need to explicitly enable it.

What must an attacker provide to trigger the resource exhaustion?

An attacker needs to cause the application to parse a crafted YAML document. The document uses aliases to apply a large sequence of empty mappings to many merge targets, producing prolonged CPU consumption despite the configured maxTotalMergeKeys limit.

Does setting maxTotalMergeKeys protect affected versions?

No. Empty mapping sources are not counted while merge keys are processed, so totalMergeKeys can remain unchanged and the configured limit may never be reached.

What versions contain the fix?

The issue is fixed in js-yaml versions 3.15.2 and 4.3.2.

REDHAT-BUG-2527118: Medium severity npm/js-yaml vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are realistically exposed to this issue?

What must an attacker provide to trigger the resource exhaustion?

Does setting maxTotalMergeKeys protect affected versions?

What versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Which applications are realistically exposed to this issue?

What must an attacker provide to trigger the resource exhaustion?

Does setting maxTotalMergeKeys protect affected versions?

What versions contain the fix?