YAML Processing Vulnerability in js-yaml JavaScript Library
CVE-2026-84375
7.5HIGH
What is CVE-2026-84375?
The js-yaml library, widely used for parsing and dumping YAML in JavaScript applications, is susceptible to a resource consumption vulnerability. This issue arises when processing merge keys in YAML documents containing empty mappings, which can lead to significant and prolonged CPU load during parsing operations. An attacker may exploit this vulnerability by crafting small YAML documents that cause excessive processing time due to an inefficient handling of merge targets. This issue affects versions from 3.0.0 to 3.15.2 and 4.3.2, with updates available to mitigate the problem.
Affected Version(s)
js-yaml >= 3.0.0, < 3.15.2 < 3.0.0, 3.15.2
js-yaml >= 4.0.0, < 4.3.2 < 4.0.0, 4.3.2