CVE-2026-84375: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit.
References
- github.com/advisories/GHSA-2883-xcg3-v3hh
- github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639
- github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480
- github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b
- github.com/nodeca/js-yaml/pull/797
- github.com/nodeca/js-yaml/releases/tag/3.15.2
- github.com/nodeca/js-yaml/releases/tag/4.3.2
- github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh
- nvd.nist.gov/vuln/detail/CVE-2026-84375
Code Behaviors & Features
Detect and mitigate CVE-2026-84375 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →