--- id: CVE-2026-84375 title: js-yaml is a JavaScript YAML parser and dumper summary: >- js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker c… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-400 - CWE-407 - CWE-835 vendor: nodeca product: js-yaml affected: - 'js-yaml >= 3.0.0, < 3.15.2' - 'js-yaml >= 4.0.0, < 4.3.2' - 'js-yaml >= 5.0.0, < 5.4.1' patched: - js-yaml 4.3.2 - js-yaml 3.15.2 published: '2026-09-01' updated: '2026-09-28' sourceUpdated: '2026-09-28T22:17:33.377' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84375' references: - url: >- https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639 label: security-advisories@github.com - url: >- https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480 label: security-advisories@github.com - url: >- https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b label: security-advisories@github.com - url: 'https://github.com/nodeca/js-yaml/pull/797' label: security-advisories@github.com - url: 'https://github.com/nodeca/js-yaml/releases/tag/3.15.2' label: security-advisories@github.com - url: 'https://github.com/nodeca/js-yaml/releases/tag/4.3.2' label: security-advisories@github.com - url: 'https://github.com/nodeca/js-yaml/releases/tag/5.4.1' label: security-advisories@github.com - url: 'https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh' label: security-advisories@github.com - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84375' - url: 'https://github.com/advisories/GHSA-2883-xcg3-v3hh' - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84375.json - url: 'https://access.redhat.com/security/cve/CVE-2026-84375' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2527118' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-84375' - url: 'https://access.redhat.com/errata/RHSA-2026:62810' - url: 'https://access.redhat.com/errata/RHSA-2026:63165' - url: 'https://access.redhat.com/errata/RHSA-2026:62813' - url: 'https://access.redhat.com/errata/RHSA-2026:66084' - url: 'https://access.redhat.com/errata/RHSA-2026:67711' - url: 'https://access.redhat.com/errata/RHSA-2026:67714' - url: 'https://access.redhat.com/errata/RHSA-2026:67279' - url: 'https://access.redhat.com/errata/RHSA-2026:68044' - url: 'https://access.redhat.com/errata/RHSA-2026:68253' - url: 'https://access.redhat.com/errata/RHSA-2026:68006' - url: 'https://access.redhat.com/errata/RHSA-2026:68254' - url: 'https://access.redhat.com/errata/RHSA-2026:63164' - url: 'https://access.redhat.com/errata/RHSA-2026:68681' - url: 'https://access.redhat.com/errata/RHSA-2026:67724' - url: 'https://access.redhat.com/errata/RHSA-2026:68754' - url: 'https://access.redhat.com/errata/RHSA-2026:68687' - url: 'https://access.redhat.com/errata/RHSA-2026:68689' - url: 'https://access.redhat.com/errata/RHSA-2026:68691' - url: 'https://access.redhat.com/errata/RHSA-2026:68690' - url: 'https://access.redhat.com/errata/RHSA-2026:69289' - url: 'https://access.redhat.com/errata/RHSA-2026:71113' - url: 'https://access.redhat.com/errata/RHSA-2026:70593' - url: 'https://access.redhat.com/errata/RHSA-2026:71210' - url: 'https://access.redhat.com/errata/RHSA-2026:71179' - url: 'https://access.redhat.com/errata/RHSA-2026:70047' - url: 'https://access.redhat.com/errata/RHSA-2026:69998' - url: 'https://access.redhat.com/errata/RHSA-2026:70027' - url: 'https://access.redhat.com/errata/RHSA-2026:72712' - url: 'https://access.redhat.com/errata/RHSA-2026:72722' - url: 'https://access.redhat.com/errata/RHSA-2026:76788' - url: 'https://access.redhat.com/errata/RHSA-2026:82151' - url: 'https://access.redhat.com/errata/RHSA-2026:79088' tags: - nvd - cve.org - ghsa - npm - csaf - vex - red-hat ssvc: exploitation: none automatable: 'yes' technicalImpact: partial timestamp: '2026-09-02T13:43:50.850378Z' aliases: - GHSA-2883-xcg3-v3hh ecosystem: npm ingestedAt: '2026-09-08T22:12:30.968Z' epss: 0.00541 epssPercentile: 0.45297 --- ## Overview js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Package advisory (CVE-2026-84375) Affected packages: - `js-yaml >= 4.0.0, < 4.3.2` - `js-yaml >= 3.0.0, < 3.15.2` Patched in: - `js-yaml 4.3.2` - `js-yaml 3.15.2` Source: https://github.com/advisories/GHSA-2883-xcg3-v3hh ## Vendor advisories - **RHSA-2026:62810** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62810) - **RHSA-2026:63165** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63165) - **RHSA-2026:62813** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62813) - **RHSA-2026:66084** · Red Hat · fixed in: Red Hat Quay 3.10 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66084) - **Red Hat VEX** · Moderate · affected: Ansible Automation Orchestrator 2026, Multicluster Engine for Kubernetes, Node HealthCheck Operator, OpenShift Lightspeed, OpenShift Pipelines, Red Hat Advanced Cluster Management for Kubernetes 2, … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Directory Server 11, Red Hat Directory Server 12, Red Hat Directory Server 13, … · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84375.json) - **RHSA-2026:67711** · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.10 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67711) - **RHSA-2026:67714** · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.11 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67714) - **RHSA-2026:67279** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67279) - **RHSA-2026:68044** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68044) - **RHSA-2026:68253** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68253) - **RHSA-2026:68006** · Red Hat · fixed in: Red Hat Edge Manager 1.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68006) - **RHSA-2026:68254** · Red Hat · fixed in: Red Hat Edge Manager 1.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68254) - **RHSA-2026:63164** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63164) - **RHSA-2026:69289** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69289) - **RHSA-2026:71113** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71113) - **RHSA-2026:70593** · Red Hat · fixed in: Network Observability (NETOBSERV) 1.12.3 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70593) - **RHSA-2026:71210** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71210) - **RHSA-2026:71179** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71179) - **RHSA-2026:70047** · Red Hat · fixed in: Red Hat Container Native Virtualization 4.12 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70047) - **RHSA-2026:69998** · Red Hat · fixed in: Red Hat Container Native Virtualization 4.14 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:69998) - **RHSA-2026:70027** · Red Hat · fixed in: Red Hat Container Native Virtualization 4.16 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70027) - **RHSA-2026:72712** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72712) - **RHSA-2026:72722** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72722) - **RHSA-2026:82151** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82151)