{"id":"CVE-2026-84375","title":"js-yaml is a JavaScript YAML parser and dumper","summary":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker c…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-400","CWE-407","CWE-835"],"vendor":"nodeca","product":"js-yaml","affected":["js-yaml >= 3.0.0, < 3.15.2","js-yaml >= 4.0.0, < 4.3.2","js-yaml >= 5.0.0, < 5.4.1"],"patched":["js-yaml 4.3.2","js-yaml 3.15.2"],"published":"2026-09-01","updated":"2026-09-28","sourceUpdated":"2026-09-28T22:17:33.377","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375","references":[{"url":"https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","label":"security-advisories@github.com"},{"url":"https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","label":"security-advisories@github.com"},{"url":"https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","label":"security-advisories@github.com"},{"url":"https://github.com/nodeca/js-yaml/pull/797","label":"security-advisories@github.com"},{"url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.2","label":"security-advisories@github.com"},{"url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.2","label":"security-advisories@github.com"},{"url":"https://github.com/nodeca/js-yaml/releases/tag/5.4.1","label":"security-advisories@github.com"},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375"},{"url":"https://github.com/advisories/GHSA-2883-xcg3-v3hh"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84375.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84375"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527118"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84375"},{"url":"https://access.redhat.com/errata/RHSA-2026:62810"},{"url":"https://access.redhat.com/errata/RHSA-2026:63165"},{"url":"https://access.redhat.com/errata/RHSA-2026:62813"},{"url":"https://access.redhat.com/errata/RHSA-2026:66084"},{"url":"https://access.redhat.com/errata/RHSA-2026:67711"},{"url":"https://access.redhat.com/errata/RHSA-2026:67714"},{"url":"https://access.redhat.com/errata/RHSA-2026:67279"},{"url":"https://access.redhat.com/errata/RHSA-2026:68044"},{"url":"https://access.redhat.com/errata/RHSA-2026:68253"},{"url":"https://access.redhat.com/errata/RHSA-2026:68006"},{"url":"https://access.redhat.com/errata/RHSA-2026:68254"},{"url":"https://access.redhat.com/errata/RHSA-2026:63164"},{"url":"https://access.redhat.com/errata/RHSA-2026:68681"},{"url":"https://access.redhat.com/errata/RHSA-2026:67724"},{"url":"https://access.redhat.com/errata/RHSA-2026:68754"},{"url":"https://access.redhat.com/errata/RHSA-2026:68687"},{"url":"https://access.redhat.com/errata/RHSA-2026:68689"},{"url":"https://access.redhat.com/errata/RHSA-2026:68691"},{"url":"https://access.redhat.com/errata/RHSA-2026:68690"},{"url":"https://access.redhat.com/errata/RHSA-2026:69289"},{"url":"https://access.redhat.com/errata/RHSA-2026:71113"},{"url":"https://access.redhat.com/errata/RHSA-2026:70593"},{"url":"https://access.redhat.com/errata/RHSA-2026:71210"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179"},{"url":"https://access.redhat.com/errata/RHSA-2026:70047"},{"url":"https://access.redhat.com/errata/RHSA-2026:69998"},{"url":"https://access.redhat.com/errata/RHSA-2026:70027"},{"url":"https://access.redhat.com/errata/RHSA-2026:72712"},{"url":"https://access.redhat.com/errata/RHSA-2026:72722"},{"url":"https://access.redhat.com/errata/RHSA-2026:76788"},{"url":"https://access.redhat.com/errata/RHSA-2026:82151"},{"url":"https://access.redhat.com/errata/RHSA-2026:79088"}],"tags":["nvd","cve.org","ghsa","npm","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-02T13:43:50.850378Z"},"aliases":["GHSA-2883-xcg3-v3hh"],"ecosystem":"npm","ingestedAt":"2026-09-08T22:12:30.968Z","epss":0.00541,"epssPercentile":0.45297,"slug":"CVE-2026-84375","body":"## Overview\n\njs-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-84375)\n\nAffected packages:\n\n- `js-yaml >= 4.0.0, < 4.3.2`\n- `js-yaml >= 3.0.0, < 3.15.2`\n\nPatched in:\n\n- `js-yaml 4.3.2`\n- `js-yaml 3.15.2`\n\nSource: https://github.com/advisories/GHSA-2883-xcg3-v3hh\n\n## Vendor advisories\n\n- **RHSA-2026:62810** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62810)\n- **RHSA-2026:63165** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63165)\n- **RHSA-2026:62813** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62813)\n- **RHSA-2026:66084** · Red Hat · fixed in: Red Hat Quay 3.10 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66084)\n- **Red Hat VEX** · Moderate · affected: Ansible Automation Orchestrator 2026, Multicluster Engine for Kubernetes, Node HealthCheck Operator, OpenShift Lightspeed, OpenShift Pipelines, Red Hat Advanced Cluster Management for Kubernetes 2, … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Directory Server 11, Red Hat Directory Server 12, Red Hat Directory Server 13, … · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84375.json)\n- **RHSA-2026:67711** · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.10 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67711)\n- **RHSA-2026:67714** · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.11 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67714)\n- **RHSA-2026:67279** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67279)\n- **RHSA-2026:68044** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68044)\n- **RHSA-2026:68253** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68253)\n- **RHSA-2026:68006** · Red Hat · fixed in: Red Hat Edge Manager 1.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68006)\n- **RHSA-2026:68254** · Red Hat · fixed in: Red Hat Edge Manager 1.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68254)\n- **RHSA-2026:63164** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63164)\n- **RHSA-2026:69289** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69289)\n- **RHSA-2026:71113** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71113)\n- **RHSA-2026:70593** · Red Hat · fixed in: Network Observability (NETOBSERV) 1.12.3 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70593)\n- **RHSA-2026:71210** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71210)\n- **RHSA-2026:71179** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71179)\n- **RHSA-2026:70047** · Red Hat · fixed in: Red Hat Container Native Virtualization 4.12 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70047)\n- **RHSA-2026:69998** · Red Hat · fixed in: Red Hat Container Native Virtualization 4.14 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:69998)\n- **RHSA-2026:70027** · Red Hat · fixed in: Red Hat Container Native Virtualization 4.16 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70027)\n- **RHSA-2026:72712** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72712)\n- **RHSA-2026:72722** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72722)\n- **RHSA-2026:82151** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82151)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}