CVE-2026-84375

Name	CVE-2026-84375
Description	js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. This issue is fixed in versions 3.15.2 and 4.3.2.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-js-yaml (PTS)	bookworm, trixie	4.1.0+dfsg+~4.0.5-7	vulnerable
	forky, sid	4.2.0+~4.0.9-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-js-yaml	source	(unstable)	(unfixed)

Notes

https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh
https://github.com/nodeca/js-yaml/pull/797
Fixed by: https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b (4.3.2)
Fixed by: https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639 (3.15.2)