Inefficient Algorithmic Complexity in js-yaml (npm) - CVE-2026-84375

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU151446

Inefficient Algorithmic Complexity in js-yaml (npm) - CVE-2026-84375

Published: September 19, 2026


Vulnerability identifier: #VU151446
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-84375
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in the js-yaml YAML loader when processing a crafted YAML document containing repeated merges of empty mappings. A remote attacker can submit a crafted YAML document to cause a denial of service.

In versions 3 and 4, merge support is enabled by default.


Affected software

js-yaml (npm)
Db2 Developer Extension
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
Nautobot
Red Hat OpenShift GitOps
Automation Assets in IBM Cloud Pak for Integration (CP4I)
IBM WebSphere Application Server
IBM WebSphere Application Server Liberty
openEuler
nodejs-js-yaml

How to mitigate CVE-2026-84375

Install security update from vendor's website.

js-yaml (npm) - addressed in versions 3.15.2, 4.3.2
Db2 Developer Extension - update to 1.2.1
Nautobot - addressed in versions 2.4.42, 3.2.5
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.26-sc2, 4.4.3
IBM WebSphere Application Server - update to 9.0.5.30
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 16.1.0.29, 16.2.0.4, 16.2.1
IBM WebSphere Application Server Liberty - update to 26.0.0.11
nodejs-js-yaml - update to 3.10.0-3
Red Hat OpenShift GitOps - update to 1.21.4

External References

Related Security Bulletins