CVE-2026-84375

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-84375
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84375.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-84375
Aliases
  • GHSA-2883-xcg3-v3hh
Downstream
Published
2026-09-01T21:43:13.617Z
Modified
2026-09-03T03:48:18.093431462Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
Details

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. This issue is fixed in versions 3.15.2 and 4.3.2.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84375.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400",
        "CWE-407"
    ]
}
References

Affected packages

Git / github.com/nodeca/js-yaml

Affected ranges

Type
GIT
Repo
https://github.com/nodeca/js-yaml
Events
Introduced
b58544b370043e30fe976aad6d62bb133325750e
Introduced
ee74ce4b4800282b2f23b776be7dc95dfe34db1c
Fixed
5c45bd6e960603c13644f5cc8b572ca257723b36
Fixed
79ca68d90f333fbe6d9e42827527e62636200191
Fixed
3485bc06ff8a0251505f44a00414d90df2466639
Fixed
6a8e05f9a485188ed730ac81e81ae221352ef480
Fixed
d90b6612a5a84385bdcb556c44578eac76dc0f6b
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.15.2"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.3.2"
        }
    ]
}

Affected versions

3.*
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.12.0
3.12.1
3.12.2
3.13.0
3.13.1
3.14.0
3.14.1
3.14.2
3.15.0
3.15.1
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.4.6
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.6.0
3.6.1
3.7.0
3.8.0
3.8.1
3.8.2
3.8.3
3.8.4
3.9.0
3.9.1
4.*
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.3.1
5.*
5.0.0
5.1.0
5.2.0
5.2.1
5.2.2
5.2.3
5.3.0
5.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84375.json"