CVE-2026-84375 js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
An attacker can cause excessive CPU consumption in applications parsing untrusted YAML by exploiting a flaw in merge key processing limits.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84375?
CVE-2026-84375 is a high-severity denial of service vulnerability in nodeca js-yaml, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.
Which versions are affected by CVE-2026-84375?
4 open source packages ship an affected version, including js-yaml.
| Package | Affected | Fixed in |
|---|---|---|
js-yaml npm | From 3.0.0 | 3.15.2 |
js-yaml npm | From 3.0.0 | 3.15.2 |
js-yaml npm | From 4.0.0 | 4.3.2 |
js-yaml npm | From 4.0.0 | 4.3.2 |
Linux distribution packages (2)
grafana12.4 Red Hat:hummingbird:1 | All versions | 0:12.4.9-0.5.hum1 |
grafana13.2 Red Hat:hummingbird:1 | All versions | 0:13.2.0-0.1.4.hum1 |
How do I fix CVE-2026-84375?
Upgrade js-yaml to a fixed version for your release line: 3.15.2 or 4.3.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-84375 being exploited?
There is no known exploitation of CVE-2026-84375 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-JR75772, CLEANSTART-2026-KE27596, CLEANSTART-2026-PJ72615, CLEANSTART-2026-PR35432, CLEANSTART-2026-TB41046, CLSA-2026-1788978094 and 47 more.