AIKIDO-2026-683761
yaml is vulnerable to Denial of Service (DoS)
25
Low Risk
This Affects:
yamlTL;DR
When the merge option is enabled, yaml expands merge (<<) key aliases during node resolution before the maxAliasCount limit is applied. Recursive merge aliases that reference anchors containing further merge aliases are followed without bound, so a small crafted document exhausts the call stack or memory while resolving to a JavaScript value. This surfaces as an uncontrolled RangeError for maximum call stack size rather than the intended bounded alias-count error, which can crash the process. The fix enforces maxAliasCount inside alias resolution so excessive merge alias expansion is rejected during resolution.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application parses untrusted YAML with the merge option enabled.
Background info
yaml is vulnerable to Denial of Service (DoS) in versions 2.0.0 - 2.9.0.
How to fix this
Upgrade the yaml library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.