js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. In v3 and v4, !!omap is active and exploitable by default. v5 doesn't use !!omap by default, and the chances of activating it are very low.This issue is fixed in 3.15.1, 4.3.1, and 5.2.1.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe Patch
- https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm Exploit, Vendor Advisory
- https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.5 · nodecaNVD modified 2026-10-25 20:10
Affected (CPE criteria) 1
cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:node.js:*:*
References 8
- https://github.com/nodeca/js-yaml/commit/22a8071ef032117bc6249c330b240ac3aa2d3ded
- https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe Patch
- https://github.com/nodeca/js-yaml/commit/c3cc4b0bb9ddb9af2dd9b61e0d56f5ce7983cd4a
- https://github.com/nodeca/js-yaml/releases/tag/3.15.1
- https://github.com/nodeca/js-yaml/releases/tag/4.3.1
- https://github.com/nodeca/js-yaml/releases/tag/5.2.1 Release Notes
- https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm Exploit, Vendor Advisory
- https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm Exploit, Vendor Advisory