CVE-2026-84375

js-yaml, a widely used npm YAML parser, has a resource-exhaustion flaw (CWE-400/CWE-407) in its YAML merge-key processing: the maxTotalMergeKeys budget does not count empty mappings ({}), so the configured limit is never reached while CPU work accumulates. An attacker who can submit a crafted YAML document — an anchored array of many empty mappings that is merged (<<) by many targets — forces O(N×K) processing that scales far beyond the document's size (e.g., ~500 KB of YAML taking ~13 seconds to parse, versus ~13 KB taking ~20 ms). The impact is denial of service through prolonged CPU consumption, with no confidentiality or integrity effect (CVSS 3.1 7.5, availability only). Any Node.js application or service that parses untrusted YAML with js-yaml is exposed, with the highest default exposure in v3 and v4 where merge processing is enabled by default; in v5 the flaw applies when merge keys are used. No exploitation is currently known: the flaw is absent from CISA KEV, no public PoC is catalogued, and EPSS estimates only a ~0.4% probability of exploitation within 30 days.

What to do: Upgrade js-yaml to a release containing the fix (each merge-source mapping counted as one budget unit) as soon as it is published; the available data does not name the fixed version, so track the project's advisory. Until then, limit the size and complexity of YAML accepted from untrusted sources, avoid exposing merge-key (<<) processing to untrusted input where the schema is configurable, and add parse timeouts or resource limits around YAML loading. Audit your dependency tree for js-yaml on any code path that parses untrusted YAML.