AIKIDO-2026-480676

js-yaml is vulnerable to Denial of Service (DoS)

GHSA-5p4m-2wfm-xmqjPublished Aug 3, 2026

CVE Score

High

Denial of Service (DoS)

TL;DR

Affected versions of this package are vulnerable to Denial of Service (DoS) in the resolver for the !!omap ordered-map tag, which enforces key uniqueness with a linear array scan performed on every element. Resolving an ordered map with n entries therefore costs quadratic time, so a modestly sized document consumes disproportionate CPU inside load. Because !!omap is part of the default schema, parsing untrusted YAML with no special options blocks the event loop and can stall an entire process. The fix replaces the per-element linear duplicate-key scan with a set-based lookup so resolution runs in linear time.

How do I fix this?

Upgrade the org.mvnpm:js-yaml library to the patch version.

Who does this affect?

You are affected if your application calls yaml.load() (or an equivalent parse entry point) on YAML that is user-controlled or otherwise untrusted while running an affected 3.x or 4.x version. No special options or custom schema are required: !!omap is registered in the default schema, so a plain load of untrusted input reaches the quadratic resolver.