Skip to main content

js-yaml EUVDEUVD-2026-69712

| CVE-2026-84375 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-09-01 GitHub_M GHSA-2883-xcg3-v3hh
Denial Of Service Suse Js Yaml Nodeca
7.5
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Network-delivered YAML parsed without authentication; impact is pure CPU exhaustion with no confidentiality or integrity breach.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
POC Analysis Generated
Sep 09, 2026 - 11:34 vuln.today
Patch available
Sep 01, 2026 - 23:18 EUVD
Source Code Evidence Fetched
Sep 01, 2026 - 22:23 vuln.today
Analysis Generated
Sep 01, 2026 - 22:23 vuln.today
CVE Published
Sep 01, 2026 - 21:43 cve.org
HIGH 7.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 5,998 npm packages depend on js-yaml (140 direct, 5,871 indirect)

Ecosystem-wide dependent count for version 4.0.0.

DescriptionCVE.org

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. This issue is fixed in versions 3.15.2 and 4.3.2.

AnalysisAI

Uncontrolled CPU consumption in js-yaml versions 3.0.0-3.15.1 and 4.0.0-4.3.1 allows unauthenticated remote attackers to exhaust server CPU by submitting a small YAML document containing aliased sequences of empty mappings merged into many targets, triggering O(N×K) processing while the library's maxTotalMergeKeys safety counter is never incremented. Any Node.js application that exposes js-yaml parsing to untrusted input is affected, because merge key (<<) processing is enabled by default on both release lines. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target application must use js-yaml 3.x before 3.15.2 or 4.x before 4.3.2 and must pass attacker-controlled content to `js-yaml.load()`, `js-yaml.safeLoad()`, or equivalent. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) accurately models the threat: network-reachable, trivial to construct, unauthenticated, no interaction, availability-only impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade js-yaml to version 3.15.2 (for 3.x consumers) or 4.3.2 (for 4.x consumers); both releases are available on npm and confirmed via tagged GitHub releases at https://github.com/nodeca/js-yaml/releases/tag/3.15.2 and https://github.com/nodeca/js-yaml/releases/tag/4.3.2. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit all Node.js applications and dependencies to identify systems using affected js-yaml versions 3.0.0-3.15.1 or 4.0.0-4.3.1 (use npm audit and scan dependency trees). …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Js Yaml

View all
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2026-59869 HIGH POC
7.5 Jul 08

Denial of service in js-yaml (a widely-used JavaScript YAML parser) 3.0.0-3.14.x and 4.0.0-4.2.x allows remote attackers
CVE-2026-59868 HIGH POC
7.5 Jul 08

Denial of service in the js-yaml Node.js YAML parser (versions 5.0.0 up to but not including 5.2.0) lets a remote attack
CVE-2026-59870 HIGH POC
7.5 Jul 08

Denial of service in the js-yaml JavaScript YAML parser (versions 5.0.0 up to but not including 5.2.1) allows remote att
CVE-2025-64718 MEDIUM
5.3 Nov 13

js-yaml is a JavaScript YAML parser and dumper. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploit

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Affected
SUSE Linux Enterprise Module for SAP Applications 15 SP7 Affected

Share

EUVD-2026-69712 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy