CVE-2026-84375

About vulnerability

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.

Affected product:

AlmaLinux 9.2 ESU , Babel , CentOS 7 ELS , CloudLinux 7 ELS , Next.js , RHEL 7 ELS , React , TuxCare 9.6 ESU , TuxCare 9.8 ESU , Vue , aegir , astro , astrojs-internal-helpers , astrojs-markdown-remark , astrojs-prism , astrojs-studio , astrojs-underscore-redirects , astrojs-upgrade , babel-code-frame , babel-core , babel-eslint-parser , babel-generator , babel-parser , babel-plugin-istanbul , babel-plugin-proposal-decorators , babel-plugin-transform-flow-strip-types , babel-plugin-transform-object-assign , babel-plugin-transform-react-display-name , babel-plugin-transform-react-jsx , babel-preset-react , babel-traverse , babel-types , blockstack.js , bls12377js , celo-connect , celo-contractkit , celo-utils , celo-wallet-base , celo-wallet-ledger , celo-wallet-local , celo-wallet-remote , codecov , config , cosmiconfig , create-sanity , css-loader , cssnano , developer-tooling , electron-mocha , ember-cli , eslint , eslint-community/eslint-utils , eslint-import-resolver-typescript , eslint-plugin-es , eslint-plugin-import , eslint-plugin-jest , eslint-plugin-jest-dom , eslint-plugin-jsx-a11y , eslint-plugin-node , eslint-plugin-react , eslint-plugin-testing-library , eslintrc , fork-ts-checker-webpack-plugin , fumadocs-sanity , gatsby , gatsby-transformer-sqip , gp-js-client , gray-matter , grunt , grunt-karma , hey-api , hey-api-client-axios , hey-api-client-fetch , hey-api-json-schema-ref-parser , js-yaml , ledgerhq-live-common , lerna , libp2p-interfaces-compliance-tests , load-nyc-config , load-yaml-file , loopback , loopback-connector , loopback-connector-remote , loopback-datasource-juggler , loopback-phase , mastra , mastra-blaxel , mastra-docker , metro , metro-babel-transformer , metro-cache , metro-config , metro-inspector-proxy , metro-react-native-babel-preset , metro-react-native-babel-transformer , metro-transform-plugins , metro-transform-worker , microsoft-api-documenter , microsoft-rush , microsoft-rush-lib , middleware , mocha , modern-js-base-generator , modern-js-generator-utils , modern-js-plugin-polyfill , modern-js-tsconfig , modern.js , npm-check , nuxt , nuxt-kit , nuxt-rspack-builder , nuxt-schema , nuxt-vite-builder , nuxt-webpack-builder , open-wc-testing-karma , open-wc-testing-karma-bs , packages , pnpm , postcss-load-config , postcss-load-options , postcss-load-plugins , postcss-loader , postcss-svgo , preferred-pm , read-yaml-file , remark-mdx-frontmatter , remix , remix-run-server-runtime , runtime-cli , rushstack , rushstack-lockfile-explorer , rushstack-lookup-by-path , rushstack-package-extractor , rushstack-rush-amazon-s3-build-cache-plugin , rushstack-rush-azure-storage-build-cache-plugin , rushstack-rush-bridge-cache-plugin , rushstack-rush-serve-plugin , sanity , sanity-access-ui , sanity-cli , sanity-cli-build , sanity-diff , sanity-mutator , sanity-plugin-mux-input , sanity-schema , sanity-types , sanity-util , sanity-vercel-protection-bypass , sanity-vision , sdk-typescript , sentry-browser , sentry-core , sentry-node , sentry-types , sentry-typescript , sqip , stacks-auth , stacks-encryption , strong-globalize , strong-remoting , stx-labs-stacks.js , stx-labs/stacks.js , svgo , swagger , swagger-js , tachyons-build-css , tachyons-generator , tanstack-ai-sandbox-blaxel , tapjs , testem , theme-ui , tslint , tslint-consistent-codestyle , turbo-workspaces , typescript-eslint , typescript-eslint-eslint-plugin , typescript-eslint-parser , typescript-eslint-project-service , typescript-eslint-rule-tester , typescript-eslint-scope-manager , typescript-eslint-tsconfig-utils , typescript-eslint-type-utils , typescript-eslint-types , typescript-eslint-typescript-estree , typescript-eslint-visitor-keys , vercel , vercel-backends , vercel-build-utils , vercel-cervel , vercel-client , vercel-elysia , vercel-express , vercel-fastify , vercel-frameworks , vercel-fs-detectors , vercel-gatsby-plugin-vercel-builder , vercel-h3 , vercel-hono , vercel-koa , vercel-nestjs , vercel-node , vercel-python , vercel-python-analysis , vercel-remix-builder , vercel-static-build , verdaccio , verdaccio-audit , verdaccio-auth , verdaccio-loaders , verdaccio-logger , verdaccio-signature , verdaccio-test-helper , verdaccio-ui-theme , verdaccio-utils , wdio-mocha-framework , which-pm , wotan

Affected packages:

js-yaml @ 3.7.0 (+2092 more)