SB20261109215 - Inefficient Algorithmic Complexity in js-yaml (npm)

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109215

SB20261109215 - Inefficient Algorithmic Complexity in js-yaml (npm)

Published: November 9, 2026

Security Bulletin ID SB20261109215
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Partial DoS

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Inefficient Algorithmic Complexity (CVE-ID: N/A)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to cause prolonged CPU consumption and reduce availability in applications using js-yaml.

The vulnerability exists due to maxTotalMergeKeys not counting empty mappings when the YAML loader processes merge keys, allowing repeated merges to bypass the configured limit. An unauthenticated remote attacker can submit a relatively small YAML document that repeatedly merges a large sequence of empty mappings, causing excessive processing when merge keys are enabled.


Remediation

Install update from vendor's website.

References