Inefficient Algorithmic Complexity in js-yaml (npm) - #VU163162
Published: November 9, 2026
Vulnerability identifier: #VU163162
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause prolonged CPU consumption and reduce availability in applications using js-yaml.
The vulnerability exists due to maxTotalMergeKeys not counting empty mappings when the YAML loader processes merge keys, allowing repeated merges to bypass the configured limit. An unauthenticated remote attacker can submit a relatively small YAML document that repeatedly merges a large sequence of empty mappings, causing excessive processing when merge keys are enabled.
Affected software
js-yaml (npm)
Remediation
Install security update from vendor's website.
js-yaml (npm) - update to 5.4.1