{"id":"CVE-2026-84375","summary":"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources","details":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key \u003c\u003c. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.","aliases":["GHSA-2883-xcg3-v3hh"],"modified":"2026-10-21T03:00:29.237213782Z","published":"2026-09-01T21:43:13.617Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-400","CWE-407"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84375.json"},"references":[{"type":"WEB","url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.2"},{"type":"WEB","url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.2"},{"type":"WEB","url":"https://github.com/nodeca/js-yaml/releases/tag/5.4.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84375.json"},{"type":"ADVISORY","url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375"},{"type":"FIX","url":"https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639"},{"type":"FIX","url":"https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480"},{"type":"FIX","url":"https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b"},{"type":"FIX","url":"https://github.com/nodeca/js-yaml/pull/797"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nodeca/js-yaml","events":[{"introduced":"b58544b370043e30fe976aad6d62bb133325750e"},{"fixed":"5c45bd6e960603c13644f5cc8b572ca257723b36"},{"introduced":"ee74ce4b4800282b2f23b776be7dc95dfe34db1c"},{"fixed":"79ca68d90f333fbe6d9e42827527e62636200191"},{"introduced":"75148bc4f5eb69b3d338e1c355d8bb2dba5bdf34"},{"fixed":"e5a3ba0efee53629b979f784cd53736f89ea61b6"},{"fixed":"3485bc06ff8a0251505f44a00414d90df2466639"},{"fixed":"6a8e05f9a485188ed730ac81e81ae221352ef480"},{"fixed":"d90b6612a5a84385bdcb556c44578eac76dc0f6b"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"3.0.0"},{"fixed":"3.15.2"}]},{"range":[{"introduced":"4.0.0"},{"fixed":"4.3.2"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"introduced":"5.0.0"},{"fixed":"5.4.1"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"fixed":"3485bc06ff8a0251505f44a00414d90df2466639"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"6a8e05f9a485188ed730ac81e81ae221352ef480"}]},{"range":[{"fixed":"d90b6612a5a84385bdcb556c44578eac76dc0f6b"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"3.15.2","range":[{"fixed":"5c45bd6e960603c13644f5cc8b572ca257723b36"}]},{"original_tag":"4.3.2","range":[{"fixed":"79ca68d90f333fbe6d9e42827527e62636200191"}],"source":"REFERENCES_TAG"},{"source":"REFERENCES_TAG","original_tag":"5.4.1","range":[{"fixed":"e5a3ba0efee53629b979f784cd53736f89ea61b6"}]}]}}],"versions":["3.15.1","4.3.1","5.4.0","5.3.0","5.2.3","3.15.0","4.3.0","5.2.2","5.2.1","3.14.2","5.2.0","5.1.0","5.0.0","4.2.0","4.1.1","3.14.1","4.1.0","4.0.0","3.14.0","3.13.1","3.13.0","3.12.2","3.12.1","3.12.0","3.11.0","3.10.0","3.9.1","3.9.0","3.8.4","3.8.3","3.8.2","3.8.1","3.8.0","3.7.0","3.6.1","3.6.0","3.5.5","3.5.4","3.5.3","3.5.2","3.5.1","3.5.0","3.4.6","3.4.5","3.4.4","3.4.3","3.4.2","3.4.1","3.4.0","3.3.1","3.3.0","3.2.7","3.2.6","3.2.5","3.2.4","3.2.3","3.2.2","3.2.1","3.2.0","3.1.0","3.0.2","3.0.1","3.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84375.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}