EUVD-2026-42302
GHSA-g796-fgmg-93mv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify endpoint parsing untrusted YAML with merges
-
DeliveryCraft small chained merge-key document
-
ExploitSubmit document to load()/loadAll()
-
ExecutionTrigger quadratic key processing
-
ImpactExhaust CPU and stall event loop
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
|
| Exploitation Conditions | Exploitation requires that the target application parse attacker-controlled YAML with js-yaml 5.0.0-5.1.x AND with merge keys (the << merge type) enabled - in practice loading with a YAML 1.1 or otherwise merge-aware schema rather than js-yaml's default schema. The malicious input is a chain of mappings where each merges the previous one (e.g. a{i}: &a{i} { <<: *a{i-1}, k{i}: {i} }), which is small on the wire but forces quadratic key processing. No authentication (PR:N), no user interaction (UI:N), and only network delivery of the document are needed once those conditions hold. The key limiting factor is the merge-keys-enabled requirement: deployments using the default schema, or that do not pass untrusted YAML to load()/loadAll(), are not exploitable, which meaningfully narrows real-world exposure below what the 7.5 network score implies. |
| Impact | The signals are internally consistent and point to a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 7.5 HIGH driven solely by availability, with no confidentiality or integrity exposure. EPSS is low (0.29%, 21st percentile) and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation. SSVC marks Exploitation=poc (matching the pathological test case shipped with the fix), Automatable=yes, and Technical Impact=partial, which is proportionate for a parser DoS. An important limiting factor the raw CVSS does not capture: exploitation requires the application to have merge keys enabled - in js-yaml this generally means loading with a YAML 1.1 / merge-aware schema rather than the default, so deployments on the default schema are not exposed. Net: a real hardening priority for services that parse untrusted YAML with merge support, but not an emergency - treat as a routine-to-prompt patch rather than a KEV-grade drop-everything item. |
| Exploit ScenarioDerived | An application that parses user-supplied YAML with merge keys enabled (for example a CI config, template engine, or API payload processor) receives a compact document containing a long chain of mappings where each merges the previous one via <<. When js-yaml constructs the document, the total keys processed explode quadratically, pinning a CPU core and stalling the Node.js event loop so the service stops responding. A proof-of-concept pattern is embodied in the project's own pathological test (createMergeChain), so exercising this against a vulnerable, merge-enabled endpoint is straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 13, 2026
Denial of service in the js-yaml Node.js YAML parser (versions 5.0.0 up to but not including 5.2.0) lets a remote attacker consume quadratic CPU time by submitting a small, linearly-sized YAML document that chains merge keys (<<) so each mapping merges the previous one. Because confidentiality and integrity impact are nil and only availability is affected (CVSS 7.5, AV:N/A:H), a single crafted document can stall or hang the parsing thread. SSVC rates this poc / automatable=yes / partial impact; there is no public weaponized exploit and it is not on CISA KEV, with a low EPSS of 0.29%.
Earlier versions of this analysis (2)
Denial of service in js-yaml 5.0.0 through 5.1.x lets remote attackers exhaust CPU by submitting a small YAML document that uses chained merge keys (<<), forcing quadratic parsing time relative to a linearly-growing input. The nodeca js-yaml library, a widely-embedded JavaScript YAML parser, mis-handles a chain of mappings where each mapping merges the previous one, so a compact payload expands into O(n²) key-folding work. Rated CVSS 7.5 (availability-only). SSVC lists a proof-of-concept as available and the flaw as automatable; EPSS is low at 0.29% and it is not in CISA KEV, so no public exploit identified as actively used at time of analysis beyond the PoC.
Quadratic CPU time consumption in js-yaml 5.0.0 through 5.1.x allows remote unauthenticated attackers to exhaust server CPU by submitting a specially crafted YAML document that exploits chained merge key resolution. Parsing time grows quadratically relative to document size, letting an attacker produce disproportionate server-side load from a small, cheap-to-send payload. No public exploit has been identified at time of analysis; the issue is fixed in version 5.2.0.
RemediationAI
Vendor-released patch: upgrade js-yaml to 5.2.0 or later, which fixes the quadratic merge-key behavior and adds the maxTotalMergeKeys loader option (default 10000) to bound merge processing (release: https://github.com/nodeca/js-yaml/releases/tag/5.2.0; advisory: https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv). If you cannot upgrade immediately, the most effective compensating control is to avoid enabling merge keys when parsing untrusted YAML - load with the default schema instead of a YAML 1.1 / merge-enabled schema, which removes the attack surface entirely at the cost of losing << merge support. Additional layered controls include enforcing strict input-size limits on YAML from untrusted sources and running parsing under a CPU/time budget (for example a worker thread with a timeout, as the project's own pathological test does) so one document cannot hang the main event loop; the trade-off is added complexity and rejecting legitimately large documents. After upgrading, applications that legitimately use merges can tune maxTotalMergeKeys to a lower value for stricter protection.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
js-yaml (published under vendor 'nodeca', CPE cpe:2.3:a:nodeca:js-yaml) is one of the most widely used JavaScript YAML parsers, invoked whenever an application calls load()/loadAll() on YAML input. The flaw is a CWE-407 Inefficient Algorithmic Complexity issue in how the merge key (<<) feature folds one mapping's keys into another: when a chain of mappings each merges the prior mapping (a0 into a1, a1 into a2, and so on), the total number of keys the constructor must process grows quadratically relative to the document's linear source size, producing an algorithmic-complexity DoS. The upstream fix commit (3105455b) confirms the root cause and remedy - the old maxMergeSeqLength cap is replaced with a new maxTotalMergeKeys loader option (default 10000) that bounds the total keys processed by merge across a single load()/loadAll() call and throws a YAMLException once exceeded.
Know when Js Yaml gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attacker sends a crafted document over the network with no auth or interaction (AV:N/PR:N/UI:N); only availability is hit via CPU exhaustion (A:H, C/I:N), and the merge-key precondition is a deployment setting, not attacker effort, so AC:L.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.
Blast Radius
ecosystem impact- 9 npm packages depend on js-yaml (7 direct, 2 indirect)
Ecosystem-wide dependent count for version 5.0.0.
Executive ViewAI
js-yaml, a widely deployed Node.js library for parsing YAML configuration and data files, contains a denial-of-service vulnerability (CVE-2026-59868) in versions 5.0.0 through 5.1.x that allows remote attackers to freeze or crash application threads, potentially causing service outages for any organization using vulnerable versions.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Uncontrolled CPU consumption in js-yaml versions 3.0.0-3.15.1 and 4.0.0-4.3.1 allows unauthenticated remote attackers to
Denial of service in js-yaml (a widely-used JavaScript YAML parser) 3.0.0-3.14.x and 4.0.0-4.2.x allows remote attackers
Denial of service in the js-yaml JavaScript YAML parser (versions 5.0.0 up to but not including 5.2.1) allows remote att
js-yaml is a JavaScript YAML parser and dumper. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploit
Exploit-DB