CVE-2026-84375 json
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
published 2026-09-01 2 mo ago modified 2026-09-28 41 d ago also GHSA-2883-xcg3-v3hh , EUVD-2026-69712
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 45%
- public exploits
- 0
- none known
Summary
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.
Patch / fix
- npm js-yaml 3.15.2, 4.3.2
- node-js-yaml Debian 14 4.3.2+~4.0.9-1
debian advisories DEBIAN-CVE-2026-84375
- receptor ansible automation platform 2.6 1.6.8-1.el10ap
- receptor ansible automation platform inside 2.6, ansible automation platform developer 2.6, ansible automation platform 2.6 1.6.8-1.el9ap
- python-sqlparse ansible automation platform developer 2.6, ansible automation platform 2.6 0.6.0-1.el10ap
- python3-sqlparse ansible automation platform developer 2.6, ansible automation platform 2.6 0.6.0-1.el10ap
- python3.12-sqlparse ansible automation platform developer 2.6, ansible automation platform 2.6 0.6.0-1.el9ap
- python3.12-gitpython ansible automation platform 2.6 3.1.60-1.el9ap
- automation-controller ansible automation platform developer 2.6, ansible automation platform 2.6 4.7.17-1.el9ap
- automation-platform-ui ansible automation platform 2.6 2.6.14-1.el9ap
red hat advisories RHSA-2026:71113RHSA-2026:63165RHSA-2026:63164RHSA-2026:62813RHSA-2026:62810
- github.com/nodeca/js-yaml@3485bc0 commit
- github.com/nodeca/js-yaml@6a8e05f commit
- github.com/nodeca/js-yaml@d90b661 commit
- github.com/nodeca/js-yaml#797 pull request
- github.com/nodeca/js-yaml/releases/tag/3.15.2 release
- github.com/nodeca/js-yaml/releases/tag/4.3.2 release
- github.com/nodeca/js-yaml/releases/tag/5.4.1 release
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-84375 updated cvss 7.5
js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing
-
Red Hat Ansible Automation Orchestrator 2026 ansible-automation-platform/automation-orchestrator-ui-rhel9 Red Hat Multicluster Engine for Kubernetes multicluster-engine/console-mce-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8, workload-availability/node-remediation-console-rhel9, workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-agentic-console-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-console-plugin-pf5-rhel9affected: no fix available
-
Red Hat Ansible Automation Platform 2 automation-controller 4.7.16-1.el9ap, ansible-automation-platform-24/lightspeed-rhel8affected: no fix planned “Will not fix”
-
Red Hat build of Apicurio Registry 3 apicurio/apicurio-registry-ui-rhel8, apicurio/apicurio-registry-gitops-sync-rhel9 Red Hat Build of Podman Desktop rh-podman-desktop, rh-podman-desktop.git 1.1.0 Red Hat Ceph Storage 4 cockpit-ceph-installer, rhceph/rhceph-4-dashboard-rhel8 Red Hat Ceph Storage 6 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +16 more Red Hat Ceph Storage 7 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +16 more Red Hat Ceph Storage 8 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +17 moreaffected: no fix available
+3 more productsfewer
Red Hat Ceph Storage 9 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +20 more Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-cnf 9.0-20240522.1.el9 Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9 -
Red Hat Directory Server 11 389-ds-base 1.4.3.39-26.module+el8dsrv+24682+4ba9f90e Red Hat Directory Server 12 389-ds-base 2.2.7-17.module+el9dsrv+24586+9fc9d4dc Red Hat Directory Server 13 389-ds-base 3.0.6-2.el10dsrvaffected: no fix planned “Will not fix”
-
Red Hat Enterprise Linux 8 grafana, 389-ds-base, grafana-loki, grafana-mssql, grafana-mysql, cockpit-389-ds, +15 more Red Hat Enterprise Linux 9 npm, nodejs, grafana, 389-ds-base, nodejs-libs, python3-lib389, +7 more Red Hat Enterprise Linux 10 ceph, nodejs26 26.1.0-1.el10, nodejs22 22.23.1-3.el10_0, nodejs24 24.19.0-1.el10_2, grafana 10.2.6-28.el10_2.4, rh-podman-desktop 1.1.2-1.el10_2 Red Hat Enterprise Linux AI (RHEL AI) 3 rust 1.92.0-1.el10, rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9affected: no fix available, no fix planned “Will not fix”
-
Red Hat Fuse 7 js-yaml 3.13.1 Red Hat Hardened Images nodejs25 25.9.0-1.6.hum1, nodejs20 20.20.2-1.2.hum1affected: no fix planned “Will not fix”
-
Red Hat JBoss Enterprise Application Platform 8 jboss-eap.1-runtime-maven-repository.zip 8.1.0 Red Hat OpenShift AI (RHOAI) rhoai/odh-core-bff-rhel9, rhoai/odh-dashboard-operator-rhel9, rhoai/odh-mod-arch-agent-ops-rhel9 Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-console-rhel9, openshift4/ose-monitoring-plugin-rhel8, openshift4/ose-monitoring-plugin-rhel9 Red Hat OpenShift Container Platform 5 openshift5/ose-console-rhel9, openshift5/ose-monitoring-plugin-rhel9, openshift5/nmstate-console-plugin-rhel9 Red Hat Openshift Data Foundation 4 odf4/ocs-client-console-rhel9, odf4/odf-multicluster-console-rhel9affected: no fix available
-
Red Hat OpenShift GitOps microshift-gitops 1.19.2-36.el9, openshift-gitops-1/argocd-rhel8, openshift-gitops-argocd-cli 1.19.2-36.el9 Red Hat Single Sign-On 7 js-yaml 3.13.1 Red Hat Secrets Management Console for Red Hat OpenShift external-secrets-management/console-plugin-rhel9affected: no fix planned “Will not fix”
show 8 moreshow fewer
-
Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 1793661804, cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 1793823428fixed: vendor fix RHSA-2026:95591
-
Red Hat Network Observability (NETOBSERV) 1.12.3 network-observability/network-observability-console-plugin-rhel9 1789978277, network-observability/network-observability-console-plugin-pf5-rhel9 1789978780fixed: vendor fix RHSA-2026:70593
-
Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2/console-rhel9 1792883111fixed: vendor fix RHSA-2026:92307
-
Red Hat Advanced Cluster Security for Kubernetes 4.11 advanced-cluster-security/rhacs-main-rhel9 1789411320fixed: vendor fix RHSA-2026:67714
-
Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 advanced-cluster-security/rhacs-main-rhel8 1789411269fixed: vendor fix RHSA-2026:67711
-
Red Hat Ansible Automation Platform 2.1 ansible-automation-platform/automation-portal 1790254963fixed: vendor fix RHSA-2026:72712
-
Red Hat Ansible Automation Platform 2.2 ansible-automation-platform/automation-portal 1790256405, ansible-automation-platform/bootc-automation-portal-rhel9 1791865660fixed: vendor fix RHSA-2026:72722
-
Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/lightspeed-rhel8 1789685837fixed: vendor fix RHSA-2026:71210
40 more fixed, 53 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | js-yaml | >=4.0.0, <4.3.2 >=3.0.0, <3.15.2 |
4.3.2 3.15.2 |
Affected products
- nodeca js-yaml
Classification
References
-
github.com
/nodeca/js-yaml/pull/797
web
-
github.com
/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639
web
-
github.com
/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480
web
-
github.com
/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b
web
-
github.com
/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh
web
-
github.com
/nodeca/js-yaml/releases/tag/3.15.2
web
-
github.com
/nodeca/js-yaml/releases/tag/4.3.2
web
- github.com /nodeca/js-yaml/releases/tag/5.4.1
-
nvd.nist.gov
/vuln/detail/CVE-2026-84375
advisory
-
github.com
/nodeca/js-yaml
package
Sources
- CVE List CVE-2026-84375
- GitHub Advisory GHSA-2883-xcg3-v3hh
- NVD CVE-2026-84375
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.