CVE-2026-84375: 
JavaScript vulnerability analysis and mitigation

CVE-2026-84375 is a Denial of Service vulnerability in the js-yaml JavaScript YAML parser and dumper (by nodeca) caused by inefficient algorithmic complexity when processing YAML merge keys (<<) with empty mapping sources. Affected versions are >= 3.0.0, < 3.15.2 and >= 4.0.0, < 4.3.2; the issue is fixed in versions 3.15.2 and 4.3.2. The vulnerability was published on September 1, 2026, with the GitHub Security Advisory (GHSA-2883-xcg3-v3hh) published on September 8, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is an incomplete resource-consumption guard in lib/js-yaml/loader.js (v3.x) and lib/loader.js / src/parser/constructor.ts (v4.x), classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-407 (Inefficient Algorithmic Complexity). The maxTotalMergeKeys counter, introduced to prevent a prior quadratic merge-key DoS (GHSA-g796-fgmg-93mv), only increments when a merge source contributes at least one key — empty mappings ({}) cost real iteration work but never increment the counter, so the guard never fires. An attacker can craft a YAML document that aliases a large sequence of N empty mappings (&arr) into K merge targets, causing O(N × K) processing while totalMergeKeys remains at zero. A PoC is publicly available in the GitHub advisory: a ~500 KB document with N=K=20,000 takes approximately 13 seconds to parse on a single core, and the attack scales quadratically (GitHub Advisory, PR #797).

Successful exploitation causes prolonged CPU exhaustion on any Node.js application that parses untrusted YAML using affected versions of js-yaml with merge processing enabled (which is the default for YAML 1.1 / YAML11_SCHEMA configurations). There is no confidentiality or integrity impact — the vulnerability is purely an availability (DoS) issue. Because js-yaml is an extremely widely used npm dependency, the blast radius extends to a large number of downstream applications and services that accept user-supplied YAML input (GitHub Advisory, Red Hat CVE).

No in-the-wild exploitation has been reported, and no exploit kits or threat actor attribution are associated with this vulnerability. A functional proof-of-concept payload is publicly documented in the GitHub Security Advisory, making the attack trivially reproducible. The NVD SSVC assessment marks the vulnerability as automatable (no user interaction required) with no known exploitation at time of publication. The EPSS score is approximately 0.385%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Red Hat CVE).

1. Identify a target: Find an application that accepts untrusted YAML input and parses it using js-yaml versions >= 3.0.0 < 3.15.2 or >= 4.0.0 < 4.3.2 with merge key support enabled (default for YAML 1.1 / YAML11_SCHEMA).
2. Craft the malicious payload: Construct a YAML document that defines an anchor referencing a large sequence of N empty mappings, then references that anchor in K merge targets:

arr: &arr [{}, {}, {}, ...]  # N empty mappings
targets:
  - <<: *arr  # repeated K times

3. Tune payload size: Adjust N and K to balance payload size against desired CPU consumption. For example, N=K=20,000 produces a ~500 KB document that takes ~13 seconds to parse on a single core; a ~1 MB document projects to minutes of CPU time.
4. Submit the payload: Deliver the crafted YAML document to the target application via any input channel that triggers YAML parsing (e.g., API endpoint, file upload, configuration input).
5. Achieve DoS: The parser enters O(N × K) processing while the maxTotalMergeKeys guard never fires, causing the server process to consume excessive CPU and become unresponsive or severely degraded (GitHub Advisory, PR #797).

• Application Logs: Requests containing YAML bodies with repeated <<: merge keys referencing anchored sequences of empty mappings ({}); unusually long YAML parse durations logged by application-level timing middleware.
• Process/System: Node.js process(es) sustaining near-100% CPU utilization for extended periods (seconds to minutes) without corresponding high memory usage; CPU spikes correlated with incoming YAML-accepting API requests.
• Network: Inbound HTTP requests with large YAML payloads (hundreds of KB) to endpoints that accept YAML input, particularly containing repeated anchor references (*arr) and merge key patterns (<<:).
• Monitoring/Alerting: Elevated response latency or timeouts on YAML-parsing endpoints; event loop lag alerts in Node.js APM tools (e.g., New Relic, Datadog) coinciding with specific request patterns (GitHub Advisory).

Upgrade js-yaml to the patched versions: 3.15.2 (for the v3.x line) or 4.3.2 (for the v4.x line). The fix modifies mergeMappings to charge one unit against maxTotalMergeKeys per merge source mapping regardless of whether it contributes any keys, and additionally hard-limits merge sequences to 100 elements. If an immediate upgrade is not possible, consider disabling YAML 1.1 merge key support by avoiding YAML11_SCHEMA or CORE_SCHEMA.withTags(mergeTag), or by rejecting/sanitizing YAML input containing <<: merge keys at the application layer before parsing (GitHub Advisory, Commit 3485bc0, Commit d90b661).

The fix was contributed via a community pull request (PR #797 by spokodev) and merged by maintainer puzrin on August 26, 2026; the maintainer noted a preference for future reports to go through the standard security disclosure channel rather than a public PR. The vulnerability attracted broad ecosystem attention, with hundreds of downstream projects (including Backstage, Lightdash, Vercel, Azure, and OpenAM) opening or merging dependency bump PRs within days of the advisory publication. Snyk added detection support via CLI v1.1307 shortly after disclosure (PR #797, GitHub Advisory).