EUVD-2026-42300
GHSA-724g-mxrg-4qvm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessFind endpoint parsing untrusted YAML with YAML11_SCHEMA
-
DeliveryCraft !!omap with thousands of unique keys
-
ExploitSubmit document to yaml.load()
-
ExecutionTrigger O(n^2) duplicate-key scan
-
PersistExhaust CPU / stall event loop
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
|
| Exploitation Conditions | Exploitation requires the target application to (1) call js-yaml's load()/yaml.load() on attacker-controlled input and (2) be explicitly configured with the non-default YAML11_SCHEMA, since the vulnerable !!omap tag handler is not present in the default schema. The payload must be a YAML document using the !!omap tag with a large number of entries to trigger the O(n^2) key-scan. Limiting factors: YAML11_SCHEMA is no longer the default in js-yaml v5, so default deployments are NOT affected; there is no authentication or user interaction required by the parser itself (PR:N/UI:N), but the practical prerequisite of a non-default schema plus untrusted-input parsing substantially narrows the exposed population. |
| Impact | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects a network-reachable, unauthenticated availability-only impact, which is consistent with a DoS. However, the AC:L rating understates a real limiting factor: the vulnerable path requires the application to be configured with the non-default YAML11_SCHEMA and to parse attacker-controlled YAML, so in practice attack complexity is higher than a raw AC:L implies. The vendor's own changelog notes the regression is 'usually not critical, because YAML11_SCHEMA is not default anymore,' reinforcing that most deployments are not exposed. SSVC (Exploitation: poc, Automatable: yes, Technical Impact: partial) and a low EPSS (0.29%, 21st percentile) with no KEV listing together indicate this is a genuine but low-urgency issue rather than a widespread active threat. Note a data conflict: the input Tags label this 'Information Disclosure,' but the CVSS impact metrics (C:N/I:N/A:H) and the root cause clearly make this an availability/DoS issue, not information disclosure - the tag appears mislabeled and should not drive prioritization. |
| Exploit ScenarioDerived | An attacker identifies a web service or CI/config endpoint that parses user-supplied YAML with js-yaml configured to use YAML11_SCHEMA. They submit a single crafted document beginning with !!omap followed by thousands of unique single-key entries; the quadratic duplicate-key scan pins a CPU core and stalls the Node.js event loop, degrading or denying service. A proof-of-concept exploitation status is noted by SSVC and the trigger is trivial to reproduce, though no weaponized public exploit or active exploitation is confirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 10, 2026
Denial of service in the js-yaml JavaScript YAML parser (versions 5.0.0 up to but not including 5.2.1) allows remote attackers to exhaust CPU by submitting a crafted YAML document containing an ordered-map (!!omap) node with many entries. Because the !!omap handler performs a linear duplicate-key scan on every insertion, parsing scales as O(n^2), so a modestly sized payload can consume disproportionate CPU when yaml.load() is called. Exploitation is gated behind the non-default YAML11_SCHEMA; SSVC lists proof-of-concept exploit status, there is no CISA KEV entry, and EPSS is low at 0.29%.
Earlier versions of this analysis (2)
Uncontrolled resource consumption in the js-yaml Node.js/JavaScript YAML parser (versions 5.0.0 up to 5.2.1) lets a remote attacker exhaust CPU by submitting a crafted !!omap ordered-map document that is parsed under the non-default YAML11_SCHEMA. The flawed omapTag.addItem() performs a linear duplicate-key scan on every insertion, producing O(n²) behavior that blocks the single-threaded event loop and denies service. SSVC lists proof-of-concept exploit maturity and marks the flaw automatable; it is not in CISA KEV and EPSS is low (0.29%, 21st percentile), and the fix ships in js-yaml 5.2.1.
CPU exhaustion in js-yaml 5.0.0-5.2.0 allows unauthenticated remote attackers to trigger denial of service by submitting crafted YAML documents containing !!omap ordered-map sequences. The omapTag.addItem() function performs a linear duplicate-key scan on every insertion under YAML11_SCHEMA, producing O(n²) CPU consumption that scales with the number of keys in a malicious payload. A vendor-released patch is available in version 5.2.1; no public exploit code has been identified at time of analysis.
RemediationAI
Upgrade js-yaml to version 5.2.1 or later (Vendor-released patch: 5.2.1), which replaces the quadratic duplicate-key scan with an O(1) Set-based check per the fixing commit 39f3211a2f01b3c6982710cf21434ab7060acefe; see the advisory at https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm and release notes at https://github.com/nodeca/js-yaml/releases/tag/5.2.1. If you cannot upgrade immediately, the most effective compensating control is to stop passing schema: YAML11_SCHEMA to load()/yaml.load() and use the default schema, which does not process the !!omap tag and eliminates the vulnerable path entirely - the trade-off is loss of YAML 1.1 !!omap parsing for any legitimate documents that rely on it. Where untrusted YAML must be parsed, additionally enforce strict input size limits and parse within a timeout or worker/child process so a single malicious document cannot pin the main event loop. Run npm audit/update transitive dependencies, since js-yaml is frequently pulled in indirectly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
js-yaml is one of the most widely used YAML parsers in the Node.js/JavaScript ecosystem, commonly embedded in build tooling, config loaders, and web backends. The flaw lives in src/tag/sequence/omap.ts, which implements the YAML 1.1 !!omap (ordered map) tag. The pre-fix addItem() appended each map entry to an array and, for every insertion, iterated the entire existing container to detect duplicate keys - an O(n) check per item, yielding O(n^2) total work across n items. This is a textbook instance of CWE-407 (Inefficient Algorithmic Complexity / algorithmic-complexity DoS), where attacker-controlled input size drives quadratic resource growth. The 5.2.1 fix replaces the linear scan with a Set-based (O(1) average) duplicate check via a carrier object holding a seen Set. The affected package is cpe:2.3:a:nodeca:js-yaml, and critically the vulnerable code path is only reachable when the caller explicitly selects YAML11_SCHEMA, since js-yaml no longer uses the YAML 1.1 schema (with !!omap) by default.
Know when Js Yaml gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Availability-only DoS with no auth (PR:N), but AC:H because exploitation requires the non-default YAML11_SCHEMA to be configured and untrusted YAML parsed.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. This issue is fixed in version 5.2.1.
Blast Radius
ecosystem impact- 9 npm packages depend on js-yaml (7 direct, 2 indirect)
Ecosystem-wide dependent count for version 5.0.0.
Executive ViewAI
The js-yaml JavaScript YAML parser (versions 5.0.0-5.2.0) is vulnerable to remote denial-of-service attacks that can crash or degrade services by exhausting server CPU resources. With publicly available exploit code and a CVSS score of 7.5, organizations using affected versions risk service disruption if attackers target YAML-parsing endpoints. Immediate patching is critical to protect service availability and prevent customer impact.
Apply vendor patch. For environments unable to patch immediately, implement input validation and rate limiting on YAML parsing endpoints as interim mitigation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Uncontrolled CPU consumption in js-yaml versions 3.0.0-3.15.1 and 4.0.0-4.3.1 allows unauthenticated remote attackers to
Denial of service in js-yaml (a widely-used JavaScript YAML parser) 3.0.0-3.14.x and 4.0.0-4.2.x allows remote attackers
Denial of service in the js-yaml Node.js YAML parser (versions 5.0.0 up to but not including 5.2.0) lets a remote attack
js-yaml is a JavaScript YAML parser and dumper. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploit
Exploit-DB