GHSA-r3ph-w7gj-g6xm: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

September 29, 2026

maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit.

References

github.com/advisories/GHSA-r3ph-w7gj-g6xm
github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480
github.com/nodeca/js-yaml/releases/tag/5.4.1
github.com/nodeca/js-yaml/security/advisories/GHSA-r3ph-w7gj-g6xm

Code Behaviors & Features

Detect and mitigate GHSA-r3ph-w7gj-g6xm with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →