js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7 Patch
- https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4 Patch
- https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m Exploit, Vendor Advisory
- https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.5 · nodecaNVD modified 2026-10-25 20:10
Affected (CPE criteria) 1
cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:node.js:*:*
References 6
- https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7 Patch
- https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4 Patch
- https://github.com/nodeca/js-yaml/releases/tag/3.15.0 Release Notes
- https://github.com/nodeca/js-yaml/releases/tag/4.3.0 Release Notes
- https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m Exploit, Vendor Advisory
- https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m Exploit, Vendor Advisory