PT-2026-49573 · Npm · Js-Yaml
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
js-yaml versions prior to 4.2.0
Description
A crafted YAML document can trigger algorithmic CPU exhaustion during merge-key processing (
<<) by repeating the same alias multiple times in a merge sequence. This results in quadratic parse-time behavior relative to the input size, which can block a Node.js worker or event loop for several seconds even with a small payload (tens of KB), leading to a denial of service. The issue resides in the merge handling within lib/loader.js, specifically inside the storeMappingPair() function and the mergeMappings() function. When a merge value is a sequence, the parser processes each element without deduplication; if multiple entries refer to the same anchored object, the parser redundantly re-processes all keys for each reference.Recommendations
Update to version 4.2.0.
As a temporary workaround, restrict the processing of untrusted YAML documents that utilize merge-key sequences until the update is applied.
Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Js-Yaml