AIKIDO-2026-480676

js-yaml is vulnerable to Denial of Service (DoS)

Denial of Service (DoS)GHSA-5p4m-2wfm-xmqj Published 4 days ago

High Risk

This Affects:

js-yaml

3.0.0 - 3.15.0

Fixed in 3.15.1

4.0.0 - 4.3.0

Fixed in 4.3.1

Are you affected? Scan for Free

TL;DR

Affected versions of this package are vulnerable to Denial of Service (DoS) in the resolver for the !!omap ordered-map tag, which enforces key uniqueness with a linear array scan performed on every element. Resolving an ordered map with n entries therefore costs quadratic time, so a modestly sized document consumes disproportionate CPU inside load. Because !!omap is part of the default schema, parsing untrusted YAML with no special options blocks the event loop and can stall an entire process. The fix replaces the per-element linear duplicate-key scan with a set-based lookup so resolution runs in linear time.

Who does this affect?

You are affected if your application calls yaml.load() (or an equivalent parse entry point) on YAML that is user-controlled or otherwise untrusted while running an affected 3.x or 4.x version. No special options or custom schema are required: !!omap is registered in the default schema, so a plain load of untrusted input reaches the quadratic resolver.