CVE-2026-84375

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400",
        "CWE-407"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84375.json"
}

References

Affected packages

Git / github.com/nodeca/js-yaml

Affected ranges

Type

GIT

Repo

https://github.com/nodeca/js-yaml

Events

Introduced

b58544b370043e30fe976aad6d62bb133325750e

Introduced

ee74ce4b4800282b2f23b776be7dc95dfe34db1c

Introduced

75148bc4f5eb69b3d338e1c355d8bb2dba5bdf34

Fixed

5c45bd6e960603c13644f5cc8b572ca257723b36

Fixed

79ca68d90f333fbe6d9e42827527e62636200191

Fixed

e5a3ba0efee53629b979f784cd53736f89ea61b6

Fixed

3485bc06ff8a0251505f44a00414d90df2466639

Fixed

6a8e05f9a485188ed730ac81e81ae221352ef480

Fixed

d90b6612a5a84385bdcb556c44578eac76dc0f6b

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.15.2"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.3.2"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.4.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

3.*

3.0.0

3.0.1

3.0.2

3.1.0

3.10.0

3.11.0

3.12.0

3.12.1

3.12.2

3.13.0

3.13.1

3.14.0

3.14.1

3.14.2

3.15.0

3.15.1

3.2.0

3.2.1

3.2.2

3.2.3

3.2.4

3.2.5

3.2.6

3.2.7

3.3.0

3.3.1

3.4.0

3.4.1

3.4.2

3.4.3

3.4.4

3.4.5

3.4.6

3.5.0

3.5.1

3.5.2

3.5.3

3.5.4

3.5.5

3.6.0

3.6.1

3.7.0

3.8.0

3.8.1

3.8.2

3.8.3

3.8.4

3.9.0

3.9.1

4.*

4.0.0

4.1.0

4.1.1

4.2.0

4.3.0

4.3.1

5.*

5.0.0

5.1.0

5.2.0

5.2.1

5.2.2

5.2.3

5.3.0

5.4.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-84375.json"